Coalition network identification

ABSTRACT

One or more computing devices, systems, and/or methods are provided. Event information associated with a plurality of events may be identified. The plurality of events may be associated with first entities corresponding to a first entity type and second entities associated with a second entity type. A first network profile associated with the first entities and the second entities may be generated based upon the event information. First representations associated with the first entities and second representations associated with the second entities may be generated based upon the first network profile. Clusters in the first representations and/or the second representations may be identified. One or more coalition networks associated with fraudulent activity may be identified based upon the clusters.

BACKGROUND

Many applications, such as websites, applications, etc. may provideplatforms for viewing media. For example, a request for media may bereceived from a device associated with a user. Responsive to receivingthe request for media, media may be transmitted to the device. However,the request for media may be fraudulent.

SUMMARY

In accordance with the present disclosure, one or more computing devicesand/or methods are provided. In an example, a first plurality of sets ofevent information associated with a first plurality of events may beidentified. The first plurality of events may be associated with a firstplurality of entities corresponding to a first entity type and a secondplurality of entities corresponding to a second entity type. A first setof event information of the first plurality of sets of event informationmay be associated with a first event of the first plurality of events.The first set of event information may be indicative of a first entity,of the first plurality of entities, associated with the first event. Thefirst set of event information may be indicative of a second entity, ofthe second plurality of entities, associated with the first event. Afirst network profile associated with the first plurality of entitiesand the second plurality of entities may be generated based upon thefirst plurality of sets of event information. The first network profilemay be indicative of one or more first sets of event metrics associatedwith the first entity and one or more entities comprising the secondentity. The second plurality of entities may comprise the one or moreentities. A first set of event metrics of the one or more first sets ofevent metrics may correspond to a measure of events associated with thefirst entity and the second entity. A first plurality of representationsassociated with the first plurality of entities may be generated basedupon the first network profile. A second plurality of representationsassociated with the second plurality of entities may be generated basedupon the first network profile. A first plurality of clusters in thefirst plurality of representations may be identified. A first cluster ofthe first plurality of clusters may correspond to a first set ofrepresentations of the first plurality of representations. A secondplurality of clusters in the second plurality of representations may beidentified. A second cluster of the second plurality of clusters maycorrespond to a second set of representations of the second plurality ofrepresentations. The first network profile may be analyzed to determinethat a first set of entities associated with the first cluster and asecond set of entities associated with the second cluster are related. Acoalition network associated with fraudulent activity may be identifiedbased upon the determination that the first set of entities and thesecond set of entities are related.

In an example, a first plurality of sets of event information associatedwith a first plurality of events may be identified. The first pluralityof events may be associated with a first plurality of entitiescorresponding to a first entity type and a second plurality of entitiescorresponding to a second entity type. A first set of event informationof the first plurality of sets of event information may be associatedwith a first event of the first plurality of events. The first set ofevent information may be indicative of a first entity, of the firstplurality of entities, associated with the first event. The first set ofevent information may be indicative of a second entity, of the secondplurality of entities, associated with the first event. A first networkprofile associated with the first plurality of entities and the secondplurality of entities may be generated based upon the first plurality ofsets of event information. The first network profile may be indicativeof one or more first sets of event metrics associated with the firstentity and one or more entities comprising the second entity. The secondplurality of entities may comprise the one or more entities. A first setof event metrics of the one or more first sets of event metrics maycorrespond to a measure of events associated with the first entity andthe second entity. A first plurality of representations associated witha third plurality of entities may be generated based upon the firstnetwork profile. The third plurality of entities may comprise the firstplurality of entities and the second plurality of entities. A firstplurality of clusters in the first plurality of representations may beidentified. A first cluster of the first plurality of clusters maycorrespond to a first set of representations of the first plurality ofrepresentations. The first set of representations may be associated witha first set of entities of the first plurality of entities and a secondset of entities of the second plurality of entities. A coalition networkassociated with fraudulent activity may be identified based upon thefirst set of entities and the second set of entities.

In an example, a first plurality of sets of event information associatedwith a first plurality of events may be identified. The first pluralityof events may be associated with a first plurality of entitiescorresponding to a first entity type and a second plurality of entitiescorresponding to a second entity type. A first set of event informationof the first plurality of sets of event information may be associatedwith a first event of the first plurality of events. The first set ofevent information may be indicative of a first entity, of the firstplurality of entities, associated with the first event. The first set ofevent information may be indicative of a second entity, of the secondplurality of entities, associated with the first event. A first networkprofile associated with the first plurality of entities and the secondplurality of entities may be generated based upon the first plurality ofsets of event information. The first network profile may be indicativeof one or more first sets of event metrics associated with the secondentity and a first set of entities comprising the first entity. Thefirst plurality of entities may comprise the first set of entities. Afirst set of event metrics of the one or more first sets of eventmetrics may correspond to a measure of events associated with the firstentity and the second entity. The first network profile may be analyzedto identify the first set of entities, of the first plurality ofentities, that are related to the second entity. The first networkprofile may be analyzed to identify a second set of entities, of thesecond plurality of entities, that are related to the first set ofentities. The first network profile may be analyzed to identify a thirdset of entities, of the first plurality of entities, that are related tothe second set of entities. Multiple iterations may be performed. Aniteration of the multiple iterations may comprise at least one ofanalyzing the first network profile to identify a first output set ofentities, of the second plurality of entities, that are related to afirst input set of entities, or analyzing the first network profile toidentify a second output set of entities, of the first plurality ofentities, that are related to the first output set of entities. For aninitial iteration of the multiple iterations, the first input set ofentities may correspond to the third set of entities. For an iteration,of the multiple iterations, following the initial iteration, the firstinput set of entities may correspond to the second output set ofentities identified in a preceding iteration of the multiple iterations.The multiple iterations may be performed until at least one of adifference between the first output set of entities identified in afirst iteration of the multiple iterations and the first output set ofentities identified in a second iteration of the multiple iterationsdoes not exceed a first threshold difference, or a difference betweenthe second output set of entities identified in a third iteration of themultiple iterations and the second output set of entities identified ina fourth iteration of the multiple iterations does not exceed a secondthreshold difference. A coalition network associated with fraudulentactivity may be identified based upon one or more first entitiesidentified in the first iteration, the second iteration, the thirditeration and/or the fourth iteration.

In an example, a first plurality of sets of event information associatedwith a first plurality of events may be identified. The first pluralityof events may be associated with a first plurality of entitiescorresponding to a first entity type and a second plurality of entitiescorresponding to a second entity type. A first set of event informationof the first plurality of sets of event information may be associatedwith a first event of the first plurality of events. The first set ofevent information may be indicative of a first entity, of the firstplurality of entities, associated with the first event. The first set ofevent information may be indicative of a second entity, of the secondplurality of entities, associated with the first event. The firstplurality of sets of event information may be analyzed to identify afirst set of entities, of the first plurality of entities, that arerelated to the second entity. The first set of entities may comprise thefirst entity. The first plurality of sets of event information may beanalyzed to identify a second set of entities, of the second pluralityof entities, that are related to the first set of entities. The firstplurality of sets of event information may be analyzed to identify athird set of entities, of the first plurality of entities, that arerelated to the second set of entities. Multiple iterations may beperformed. An iteration of the multiple iterations may comprise at leastone of analyzing the first plurality of sets of event information toidentify a first output set of entities, of the second plurality ofentities, that are related to a first input set of entities, oranalyzing the first plurality of sets of event information to identify asecond output set of entities, of the first plurality of entities, thatare related to the first output set of entities. For an initialiteration of the multiple iterations, the first input set of entitiesmay correspond to the third set of entities. For an iteration, of themultiple iterations, following the initial iteration, the first inputset of entities may correspond to the second output set of entitiesidentified in a preceding iteration of the multiple iterations. Themultiple iterations may be performed until at least one of a differencebetween the first output set of entities identified in a first iterationof the multiple iterations and the first output set of entitiesidentified in a second iteration of the multiple iterations does notexceed a first threshold difference, or a difference between the secondoutput set of entities identified in a third iteration of the multipleiterations and the second output set of entities identified in a fourthiteration of the multiple iterations does not exceed a second thresholddifference. A coalition network associated with fraudulent activity maybe identified based upon one or more first entities identified in thefirst iteration, the second iteration, the third iteration and/or thefourth iteration.

DESCRIPTION OF THE DRAWINGS

While the techniques presented herein may be embodied in alternativeforms, the particular embodiments illustrated in the drawings are only afew examples that are supplemental of the description provided herein.These embodiments are not to be interpreted in a limiting manner, suchas limiting the claims appended hereto.

FIG. 1 is an illustration of a scenario involving various examples ofnetworks that may connect servers and clients.

FIG. 2 is an illustration of a scenario involving an exampleconfiguration of a server that may utilize and/or implement at least aportion of the techniques presented herein.

FIG. 3 is an illustration of a scenario involving an exampleconfiguration of a client that may utilize and/or implement at least aportion of the techniques presented herein.

FIG. 4 is a flow chart illustrating an example method for identifyingcoalition networks.

FIG. 5A is a component block diagram illustrating an example system foridentifying coalition networks, where a first client device presentsand/or accesses a first web page using a browser.

FIG. 5B is a component block diagram illustrating an example system foridentifying coalition networks, where a first client device presents aplurality of search results associated with a query.

FIG. 5C is a component block diagram illustrating an example system foridentifying coalition networks, where a first client device transmits arequest to access a resource to a server.

FIG. 5D is a component block diagram illustrating an example system foridentifying coalition networks, where a first server transmits a firstrequest for content to a second server associated with a content system.

FIG. 5E is a component block diagram illustrating an example system foridentifying coalition networks, where a first client device presentsand/or accesses a fourth web page using a browser.

FIG. 5F is a component block diagram illustrating a representation of afirst network profile generated by an example system for identifyingcoalition networks.

FIG. 5G is a component block diagram illustrating an example system foridentifying coalition networks, where a first plurality ofrepresentations and a second plurality of representations are generated.

FIG. 5H is a component block diagram illustrating an example system foridentifying coalition networks, where one or more coalition networks areidentified based upon a first plurality of representations and a secondplurality of representations.

FIG. 6 is a flow chart illustrating an example method for identifyingcoalition networks.

FIG. 7A is a component block diagram illustrating an example system forperforming an iterative process for identifying a coalition network,where some of the iterative process is performed.

FIG. 7B is a component block diagram illustrating an example system foridentifying coalition networks, where two iterations of multipleiterations of the iterative process are performed.

FIG. 8 is an illustration of a scenario featuring an examplenon-transitory machine readable medium in accordance with one or more ofthe provisions set forth herein.

DETAILED DESCRIPTION

Subject matter will now be described more fully hereinafter withreference to the accompanying drawings, which form a part hereof, andwhich show, by way of illustration, specific example embodiments. Thisdescription is not intended as an extensive or detailed discussion ofknown concepts. Details that are known generally to those of ordinaryskill in the relevant art may have been omitted, or may be handled insummary fashion.

The following subject matter may be embodied in a variety of differentforms, such as methods, devices, components, and/or systems.Accordingly, this subject matter is not intended to be construed aslimited to any example embodiments set forth herein. Rather, exampleembodiments are provided merely to be illustrative. Such embodimentsmay, for example, take the form of hardware, software, firmware or anycombination thereof.

1. Computing Scenario

The following provides a discussion of some types of computing scenariosin which the disclosed subject matter may be utilized and/orimplemented.

1.1. Networking

FIG. 1 is an interaction diagram of a scenario 100 illustrating aservice 102 provided by a set of servers 104 to a set of client devices110 via various types of networks. The servers 104 and/or client devices110 may be capable of transmitting, receiving, processing, and/orstoring many types of signals, such as in memory as physical memorystates.

The servers 104 of the service 102 may be internally connected via alocal area network 106 (LAN), such as a wired network where networkadapters on the respective servers 104 are interconnected via cables(e.g., coaxial and/or fiber optic cabling), and may be connected invarious topologies (e.g., buses, token rings, meshes, and/or trees). Theservers 104 may be interconnected directly, or through one or more othernetworking devices, such as routers, switches, and/or repeaters. Theservers 104 may utilize a variety of physical networking protocols(e.g., Ethernet and/or Fiber Channel) and/or logical networkingprotocols (e.g., variants of an Internet Protocol (IP), a TransmissionControl Protocol (TCP), and/or a User Datagram Protocol (UDP). The localarea network 106 may include, e.g., analog telephone lines, such as atwisted wire pair, a coaxial cable, full or fractional digital linesincluding T1, T2, T3, or T4 type lines, Integrated Services DigitalNetworks (ISDNs), Digital Subscriber Lines (DSLs), wireless linksincluding satellite links, or other communication links or channels,such as may be known to those skilled in the art. The local area network106 may be organized according to one or more network architectures,such as server/client, peer-to-peer, and/or mesh architectures, and/or avariety of roles, such as administrative servers, authenticationservers, security monitor servers, data stores for objects such as filesand databases, business logic servers, time synchronization servers,and/or front-end servers providing a user-facing interface for theservice 102.

Likewise, the local area network 106 may comprise one or moresub-networks, such as may employ differing architectures, may becompliant or compatible with differing protocols and/or may interoperatewithin the local area network 106. Additionally, a variety of local areanetworks 106 may be interconnected; e.g., a router may provide a linkbetween otherwise separate and independent local area networks 106.

In the scenario 100 of FIG. 1, the local area network 106 of the service102 is connected to a wide area network 108 (WAN) that allows theservice 102 to exchange data with other services 102 and/or clientdevices 110. The wide area network 108 may encompass variouscombinations of devices with varying levels of distribution andexposure, such as a public wide-area network (e.g., the Internet) and/ora private network (e.g., a virtual private network (VPN) of adistributed enterprise).

In the scenario 100 of FIG. 1, the service 102 may be accessed via thewide area network 108 by a user 112 of one or more client devices 110,such as a portable media player (e.g., an electronic text reader, anaudio device, or a portable gaming, exercise, or navigation device); aportable communication device (e.g., a camera, a phone, a wearable or atext chatting device); a workstation; and/or a laptop form factorcomputer. The respective client devices 110 may communicate with theservice 102 via various connections to the wide area network 108. As afirst such example, one or more client devices 110 may comprise acellular communicator and may communicate with the service 102 byconnecting to the wide area network 108 via a wireless local areanetwork 106 provided by a cellular provider. As a second such example,one or more client devices 110 may communicate with the service 102 byconnecting to the wide area network 108 via a wireless local areanetwork 106 provided by a location such as the user's home or workplace(e.g., a WiFi (Institute of Electrical and Electronics Engineers (IEEE)Standard 802.11) network or a Bluetooth (IEEE Standard 802.15.1)personal area network). In this manner, the servers 104 and the clientdevices 110 may communicate over various types of networks. Other typesof networks that may be accessed by the servers 104 and/or clientdevices 110 include mass storage, such as network attached storage(NAS), a storage area network (SAN), or other forms of computer ormachine readable media.

1.2. Server Configuration

FIG. 2 presents a schematic architecture diagram 200 of a server 104that may utilize at least a portion of the techniques provided herein.Such a server 104 may vary widely in configuration or capabilities,alone or in conjunction with other servers, in order to provide aservice such as the service 102.

The server 104 may comprise one or more processors 210 that processinstructions. The one or more processors 210 may optionally include aplurality of cores; one or more coprocessors, such as a mathematicscoprocessor or an integrated graphical processing unit (GPU); and/or oneor more layers of local cache memory. The server 104 may comprise memory202 storing various forms of applications, such as an operating system204; one or more server applications 206, such as a hypertext transportprotocol (HTTP) server, a file transfer protocol (FTP) server, or asimple mail transport protocol (SMTP) server; and/or various forms ofdata, such as a database 208 or a file system. The server 104 maycomprise a variety of peripheral components, such as a wired and/orwireless network adapter 214 connectible to a local area network and/orwide area network; one or more storage components 216, such as a harddisk drive, a solid-state storage device (SSD), a flash memory device,and/or a magnetic and/or optical disk reader.

The server 104 may comprise a mainboard featuring one or morecommunication buses 212 that interconnect the processor 210, the memory202, and various peripherals, using a variety of bus technologies, suchas a variant of a serial or parallel AT Attachment (ATA) bus protocol; aUniform Serial Bus (USB) protocol; and/or Small Computer SystemInterface (SCI) bus protocol. In a multibus scenario, a communicationbus 212 may interconnect the server 104 with at least one other server.Other components that may optionally be included with the server 104(though not shown in the schematic diagram 200 of FIG. 2) include adisplay; a display adapter, such as a graphical processing unit (GPU);input peripherals, such as a keyboard and/or mouse; and a flash memorydevice that may store a basic input/output system (BIOS) routine thatfacilitates booting the server 104 to a state of readiness.

The server 104 may operate in various physical enclosures, such as adesktop or tower, and/or may be integrated with a display as an“all-in-one” device. The server 104 may be mounted horizontally and/orin a cabinet or rack, and/or may simply comprise an interconnected setof components. The server 104 may comprise a dedicated and/or sharedpower supply 218 that supplies and/or regulates power for the othercomponents. The server 104 may provide power to and/or receive powerfrom another server and/or other devices. The server 104 may comprise ashared and/or dedicated climate control unit 220 that regulates climateproperties, such as temperature, humidity, and/or airflow. Many suchservers 104 may be configured and/or adapted to utilize at least aportion of the techniques presented herein.

1.3. Client Device Configuration

FIG. 3 presents a schematic architecture diagram 300 of a client device110 whereupon at least a portion of the techniques presented herein maybe implemented. Such a client device 110 may vary widely inconfiguration or capabilities, in order to provide a variety offunctionality to a user such as the user 112. The client device 110 maybe provided in a variety of form factors, such as a desktop or towerworkstation; an “all-in-one” device integrated with a display 308; alaptop, tablet, convertible tablet, or palmtop device; a wearable devicemountable in a headset, eyeglass, earpiece, and/or wristwatch, and/orintegrated with an article of clothing; and/or a component of a piece offurniture, such as a tabletop, and/or of another device, such as avehicle or residence. The client device 110 may serve the user in avariety of roles, such as a workstation, kiosk, media player, gamingdevice, and/or appliance.

The client device 110 may comprise one or more processors 310 thatprocess instructions. The one or more processors 310 may optionallyinclude a plurality of cores; one or more coprocessors, such as amathematics coprocessor or an integrated graphical processing unit(GPU); and/or one or more layers of local cache memory. The clientdevice 110 may comprise memory 301 storing various forms ofapplications, such as an operating system 303; one or more userapplications 302, such as document applications, media applications,file and/or data access applications, communication applications such asweb browsers and/or email clients, utilities, and/or games; and/ordrivers for various peripherals. The client device 110 may comprise avariety of peripheral components, such as a wired and/or wirelessnetwork adapter 306 connectible to a local area network and/or wide areanetwork; one or more output components, such as a display 308 coupledwith a display adapter (optionally including a graphical processing unit(GPU)), a sound adapter coupled with a speaker, and/or a printer; inputdevices for receiving input from the user, such as a keyboard 311, amouse, a microphone, a camera, and/or a touch-sensitive component of thedisplay 308; and/or environmental sensors, such as a global positioningsystem (GPS) receiver 319 that detects the location, velocity, and/oracceleration of the client device 110, a compass, accelerometer, and/orgyroscope that detects a physical orientation of the client device 110.Other components that may optionally be included with the client device110 (though not shown in the schematic architecture diagram 300 of FIG.3) include one or more storage components, such as a hard disk drive, asolid-state storage device (SSD), a flash memory device, and/or amagnetic and/or optical disk reader; and/or a flash memory device thatmay store a basic input/output system (BIOS) routine that facilitatesbooting the client device 110 to a state of readiness; and a climatecontrol unit that regulates climate properties, such as temperature,humidity, and airflow.

The client device 110 may comprise a mainboard featuring one or morecommunication buses 312 that interconnect the processor 310, the memory301, and various peripherals, using a variety of bus technologies, suchas a variant of a serial or parallel AT Attachment (ATA) bus protocol;the Uniform Serial Bus (USB) protocol; and/or the Small Computer SystemInterface (SCI) bus protocol. The client device 110 may comprise adedicated and/or shared power supply 318 that supplies and/or regulatespower for other components, and/or a battery 304 that stores power foruse while the client device 110 is not connected to a power source viathe power supply 318. The client device 110 may provide power to and/orreceive power from other client devices.

In some scenarios, as a user 112 interacts with a software applicationon a client device 110 (e.g., an instant messenger and/or electronicmail application), descriptive content in the form of signals or storedphysical states within memory (e.g., an email address, instant messengeridentifier, phone number, postal address, message content, date, and/ortime) may be identified. Descriptive content may be stored, typicallyalong with contextual content. For example, the source of a phone number(e.g., a communication received from another user via an instantmessenger application) may be stored as contextual content associatedwith the phone number. Contextual content, therefore, may identifycircumstances surrounding receipt of a phone number (e.g., the date ortime that the phone number was received), and may be associated withdescriptive content. Contextual content, may, for example, be used tosubsequently search for associated descriptive content. For example, asearch for phone numbers received from specific individuals, receivedvia an instant messenger application or at a given date or time, may beinitiated. The client device 110 may include one or more servers thatmay locally serve the client device 110 and/or other client devices ofthe user 112 and/or other individuals. For example, a locally installedwebserver may provide web content in response to locally submitted webrequests. Many such client devices 110 may be configured and/or adaptedto utilize at least a portion of the techniques presented herein.

2. Presented Techniques

One or more computing devices and/or techniques for identifyingcoalition networks associated with fraudulent activity are provided. Acoalition network is a network of entities, such as internet resources(e.g., websites, web pages, domains, applications, etc.) and/or clients(e.g., client devices, IP addresses, etc.), working together to performfraudulent activity. An example of such fraudulent activity may include,but is not limited to, advertising fraud. Other examples of fraudulentactivity performed by coalition networks are data fraud, spam messaging,etc. In advertising fraud, advertisement signals associated withinternet resources and clients of the coalition network may be receivedby an advertising system. The advertisement signals may indicateadvertisement impressions, clicks, conversions, etc. performed by aclient of the coalition network in association with an internet resourceof the coalition network. However, the purported advertisementimpressions, clicks, conversions, etc. may not be performed bylegitimate users having an interest in relevant advertisements. Rather,the advertisement signals may be transmitted to the advertising systemby a system of the coalition network employing at least one of botnets,hacked client devices (e.g., zombie computers), click farms, fakewebsites, data centers, etc. Administrators of the coalition network mayrequest compensation for the purported advertisement impressions,clicks, conversions, etc., and, unless the coalition network isidentified and determined to perform fraudulent activity, theadministrators may continue being compensated. Advertising fraud isestimated to cost the advertising industry billions of dollars per yearand automated and/or real-time solutions to advertising fraud areneeded.

Some systems for detecting fraudulent activity attempt to detect fraudat an entity-level and/or an event-level. For example, such systems mayanalyze activity and/or traffic associated with a device and/or anadvertisement signal to determine, such as based upon computationlimits, whether the device and/or the advertisement signal isfraudulent. However, malicious entities develop workarounds to avoiddetection by such systems, such as by using automated programs to spreadfraudulent traffic across networks of compromised or malicious systems(e.g., botnets). For example, the automated programs may operate suchthat each individual bot looks sufficiently like a legitimate user inorder to avoid triggering event-level and/or entity-level detectors.

Accordingly, there is a need for techniques and systems for detectingfraudulent activity on a network-level. Thus, in accordance with one ormore of the techniques presented herein, a first plurality of sets ofevent information associated with a first plurality of events may beidentified. The first plurality of events may be associated with a firstplurality of entities corresponding to a first entity type and a secondplurality of entities corresponding to a second entity type. A first setof event information of the first plurality of sets of event informationmay be associated with a first event of the first plurality of events.The first set of event information may be indicative of a first entity,of the first plurality of entities, associated with the first event. Thefirst set of event information may be indicative of a second entity, ofthe second plurality of entities, associated with the first event. Afirst network profile associated with the first plurality of entitiesand the second plurality of entities may be generated based upon thefirst plurality of sets of event information. The first network profilemay be indicative of one or more first sets of event metrics associatedwith the first entity and one or more entities comprising the secondentity. A coalition network associated with fraudulent activity may beidentified based upon the first plurality of sets of event informationand/or the first network profile using one or more of the techniquesdescribed herein, such as by using one or more clustering techniquesand/or by performing one or more iterative processes.

An embodiment of identifying coalition networks is illustrated by anexample method 400 of FIG. 4. A content system for presenting contentvia devices may be provided. In some examples, the content system may bean advertisement system (e.g., an online advertising system).Alternatively and/or additionally, the content system may not be anadvertisement system. In some examples, the content system may providecontent items to be presented via pages associated with the contentsystem. For example, the pages may be associated with websites (e.g.,websites providing search engines, email services, news content,communication services, etc.) associated with the content system. Thecontent system may provide content items to be presented in (dedicated)locations throughout the pages (e.g., one or more areas of the pagesconfigured for presentation of content items). For example, a contentitem may be presented at the top of a web page associated with thecontent system (e.g., within a banner area), at the side of the web page(e.g., within a column), in a pop-up window, overlaying content of theweb page, etc. Alternatively and/or additionally, a content item may bepresented within an application associated with the content systemand/or within a game associated with the content system. Alternativelyand/or additionally, a user may be required to watch and/or interactwith the content item before the user can access content of a web page,utilize resources of an application and/or play a game.

At 402, a first plurality of sets of event information associated with afirst plurality of events may be identified. The first plurality ofevents may be associated with a first plurality of entitiescorresponding to a first entity type and a second plurality of entitiescorresponding to a second entity type. In some examples, the firstplurality of events may correspond to events that occur within a firstperiod of time.

In some examples, the first plurality of entities corresponds toclient-side (and/or user-side) entities. For example, an entity of thefirst plurality of entities may be associated with a client device. Thefirst type of entity may correspond to at least one of a client device,a device identifier associated with a device, an IP address associatedwith a device, a carrier identifier indicative of carrier informationassociated with a device, a user identifier (e.g., at least one of ausername, an email address, a user account identifier, etc.) associatedwith a device, a browser cookie, etc.

In some examples, the second plurality of entities corresponds tointernet resource-side (and/or publisher-side) entities. For example, anentity of the second plurality of entities may be associated with aninternet resource, such as at least one of a web page, a website, anapplication (e.g., a client application, a mobile application, aplatform, etc.). The second type of entity may correspond to at leastone of an internet resource, an internet resource identifier associatedwith an internet resource, a host device associated with an internetresource (e.g., the host device may comprise one or more computingdevices, storage and/or a network configured to host the internetresource), a host identifier of the host device, a domain (e.g., adomain name, a top-level domain, etc.) associated with an internetresource, an application identifier associated with an application, apublisher identifier associated with a publisher of an internetresource, etc.

In some examples, an event of the first plurality of events (and/or eachevent of the first plurality of events) may correspond to activityperformed by an entity of the first plurality of entities and/or anentity of the second plurality of entities. In an example, an event ofthe first plurality of events (and/or each event of the first pluralityof events) may correspond to a presentation of a content item (e.g.,presentation of an advertisement and/or an advertisement impression), aselection of the content item (e.g., an advertisement click), and/or aconversion event associated with the content item, where the contentitem may be provided by the content system.

A first set of event information of the first plurality of sets of eventinformation may be associated with a first event of the first pluralityof events. The first set of event information may be indicative of afirst entity (e.g., a client-side entity), of the first plurality ofentities, associated with the first event. The first set of eventinformation may be indicative of a second entity (e.g., an internetresource-side entity), of the second plurality of entities, associatedwith the first event.

FIGS. 5A-5H illustrate examples of a system 501 for identifyingcoalition networks, described with respect to the method 400 of FIG. 4.FIGS. 5A-5E illustrate examples of the first event associated with thefirst entity and the second entity. The first entity may be associatedwith a first client device 500 associated with a first user. The secondentity may be associated with one or more first internet resourcescomprising a fourth web page 544 (illustrated in FIG. 5E). In anexample, where the second entity corresponds to a domain, the one ormore first internet resources may correspond to one or more web pagesmatching the domain. The first user (and/or the first client device 500)may access and/or interact with a service, such as a browser, software,a website, an application, an operating system, an email interface, amessaging interface, a music-streaming application, a video application,etc. that provides a platform for accessing internet resources and/orviewing and/or downloading content from a server associated with thecontent system. In some examples, the content system may use deviceinformation associated with the first client device 500, such as atleast one of activity information associated with the first clientdevice 500, demographic information associated with the first user,location information associated with the first client device 500, etc.to select content for presentation to the first user.

FIG. 5A illustrates the first client device 500 presenting and/oraccessing a first web page 508 using a browser of the first clientdevice 500. The browser may comprise an address bar 502 comprising a webaddress (e.g., a uniform resource locator (URL)) of the first web page508. The first web page 508 may comprise a search interface. Forexample, the search interface may comprise a web search engine designedto search for information throughout the internet. In some examples, thefirst web page 508 may comprise a search field 506. For example, a query“stock market” may be entered into the search field 506. In someexamples, the first web page 508 may comprise a search selectable input504 corresponding to performing a search based upon the query. Forexample, the search selectable input 504 may be selected.

FIG. 5B illustrates the first client device 500 presenting a pluralityof search results associated with the query using the browser of thefirst client device 500. For example, the plurality of search resultsmay be presented within a second web page 518. For example, theplurality of search results may comprise a first search result 510corresponding to a third web page, a second search result 512corresponding to the fourth web page 544 (illustrated in FIG. 5E), athird search result 514 corresponding to a fifth web page and/or afourth search result 516 corresponding to a sixth web page.

In some examples, each search result of the plurality of search resultsmay comprise a selectable input (e.g., a link) corresponding toaccessing a web page associated with the search result. In someexamples, the second search result 512 corresponding to the fourth webpage 544 may be selected (e.g., the second search result 512 may beselected via a second selectable input corresponding to the secondsearch result 512).

FIG. 5C illustrates the first client device 500 transmitting a request522 to access a resource to a first server 524. In some examples, therequest 522 to access the resource may be transmitted responsive to thesecond search result 512 being selected. For example, the resource maycorrespond to the fourth web page 544. For example, the request 522 toaccess the resource may comprise an indication of the fourth web page544 (e.g., a web address “https://stocks.exchange.com”). Alternativelyand/or additionally, the first server 524 may be associated with thefourth web page 544.

FIG. 5D illustrates the first server 524 transmitting a first requestfor content 536 to a second server 538 associated with the contentsystem. In some examples, the first request for content 536 may betransmitted (by the first server 524) responsive to receiving therequest 522 to access the resource. Alternatively and/or additionally,the first request for content 536 may be transmitted (to the secondserver 538) by the first client device 500. In some examples, the firstrequest for content 536 may be a request to be provided with a contentitem (e.g., an advertisement, an image, a link, a video, etc.) forpresentation via the fourth web page 544.

In some examples, the first request for content 536 may comprise anindication of the first entity, such as at least one of a deviceidentifier associated with the first client device 500, an IP addressassociated with the first client device 500, a carrier identifierindicative of carrier information associated with the first clientdevice 500, a user identifier (e.g., at least one of a username, anemail address, a user account identifier, etc.) associated with thefirst client device 500, a browser cookie, etc. Alternatively and/oradditionally, the first request for content 536 may comprise anindication of the second entity (e.g., “stocks.exchange.com”), such asat least one of an internet resource identifier associated with thefourth web page 544, a domain associated with the fourth web page 544, ahost identifier of a host device associated with the fourth web page544, a publisher identifier associated with a publisher of the fourthweb page 544, etc. Accordingly, the first entity and/or the secondentity may be determined based upon the first request for content 536.

In some examples, responsive to receiving the first request for content536, a bidding process may be performed to select a content item from afirst plurality of content items participating in an auction (e.g., anauction for selection of a content item to present via the first clientdevice 500). In some examples, the first plurality of content items(participating in the auction) may comprise a first content item 546(illustrated in FIG. 5E).

In some examples, a first plurality of bid values associated with thefirst plurality of content items may be determined. In some examples,the first plurality of bid values may be determined based upon budgets(e.g., daily budgets) and/or target spend patterns associated with thefirst plurality of content items. For example, the first plurality ofbid values and/or the budgets may be received from devices associatedwith entities (e.g., advertisers, companies, brands, organizations,etc.) associated with the first plurality of content items. In someexamples, the first plurality of bid values may comprise a first bidvalue associated with the first content item 546.

In some examples, the first content item 546 may be selected from thefirst plurality of content items for presentation via the first clientdevice 500 based upon the first plurality of bid values. For example,the first content item 546 may be selected from the first plurality ofcontent items based upon a determination that the first bid valueassociated with the first content item 546 exceeds a threshold bidvalue. Alternatively and/or additionally, the first content item 546 maybe selected from the first plurality of content items based upon adetermination that the first bid value is greater than one or more otherbid values of the first plurality of bid values. Alternatively and/oradditionally, the first content item 546 may be selected from the firstplurality of content items based upon a determination that the first bidvalue is a highest bid value of the first plurality of bid values.

Alternatively and/or additionally, a first plurality of content itemscores associated with the first plurality of content items may bedetermined. For example, the first plurality of content items scores maybe determined based upon the first plurality of bid values and/or afirst plurality of click probabilities associated with the firstplurality of content items. In some examples, the first content item 546may be selected from the first plurality of content items forpresentation via the first client device 500 based upon the firstplurality of content item scores. For example, the first content item546 may be selected from the first plurality of content items based upona determination that a first content item score associated with thefirst content item 546 exceeds a threshold content item score.Alternatively and/or additionally, the first content item 546 may beselected from the first plurality of content items based upon adetermination that the first content item score is greater than one ormore other content item scores of the first plurality of content itemscores. Alternatively and/or additionally, the first content item 546may be selected from the first plurality of content items based upon adetermination that the first content item score is a highest contentitem score of the first plurality of content item scores.

In some examples, responsive to selecting the first content item 546 forpresentation via the first client device 500, the first content item 546may be transmitted to the first client device 500 for presentation viathe fourth web page 544. FIG. 5E illustrates the first client device 500presenting and/or accessing the fourth web page 544 using the browser.For example, the content system may provide the first content item 546to be presented via the fourth web page 544 while the fourth web page544 is accessed by the first client device 500.

In an example where events of the first plurality of events comprisepresentations of content, the first event of the first plurality ofevents may be detected by determining that the first content item 546 ispresented via the first client device 500. Alternatively and/oradditionally, the first event may be detected by receiving a signalindicative of the first content item 546 being presented via the firstclient device 500. For example, the first set of event information,indicative of the first event, may be stored responsive to determiningthat the first content item 546 is presented via the first client device500 and/or responsive to receiving the signal.

In an example where events of the first plurality of events comprisepresentations of threshold proportions of content items, the first eventmay be detected by determining that at least a threshold proportion ofthe first content item 546 is presented and/or displayed via the firstclient device 500. Alternatively and/or additionally, the first eventmay be detected by receiving a signal indicative of the thresholdproportion of the first content item 546 being presented and/ordisplayed via the first client device 500. For example, the first set ofevent information, indicative of the first event, may be storedresponsive to determining that the threshold proportion of the firstcontent item 546 is presented via the first client device 500 and/orresponsive to receiving the signal.

In an example where events of the first plurality of events compriseselections of content (e.g., advertisement clicks), the first event maybe detected by detecting a selection of the first content item 546 viathe first client device 500. Alternatively and/or additionally, thefirst event may be detected by receiving a signal indicative of thefirst content item 546 being selected via the first client device 500.For example, the first set of event information, indicative of the firstevent, may be stored responsive to detecting the selection of the firstcontent item 546 and/or responsive to receiving the signal.

In an example where events of the first plurality of events correspondto conversion events, the first event may be detected by detecting afirst conversion event associated with the first content item 546 andthe first client device 500. Alternatively and/or additionally, thefirst event may be detected by receiving a signal indicative of thefirst conversion event. For example, the first set of event information,indicative of the first event, may be stored responsive to detecting thefirst conversion event and/or responsive to receiving the signal.

In some examples, the first conversion event may be associated with athird entity associated with the first content item 546. The thirdentity may correspond to a third entity type. The third entity type maycorrespond to advertising-side entities, such as at least one ofadvertisements, creatives, advertisers, companies, brands,organizations, etc. associated with content items presented by thecontent system. For example, the third entity may correspond to at leastone of the first content item 546, a creative, an advertisement, anadvertiser, a company, a brand, an organization, etc. The first contentitem 546 (and/or one or more other content items associated with acontent campaign) may be used for promoting one or more products and/orone or more services.

In some examples, the first conversion event may correspond to at leastone of a purchase of a product of one or more products associated withthe third entity, a purchase of a service of one or more servicesassociated with the third entity, subscribing to (and/or signing up for)a service associated with the third entity, contacting the third entity(e.g., contacting the third entity via one or more of email, phone,etc.), a selection of a content item associated with the third entity,an interaction with a content item associated with the third entity,accessing a web page associated with the third entity, adding a productand/or a service associated with the third entity to a shopping cart onan online shopping platform, completing a form (e.g., a survey form),creating and/or registering an account (e.g., a user account) for aplatform associated with the third entity (e.g., creating a shoppinguser account for an online shopping platform), downloading anapplication (e.g., a mobile application) associated with the thirdentity onto the first client device 500 and/or installing theapplication on the first client device 500, opening and/or interactingwith the application, utilizing one or more services associated with thethird entity using the application, etc.

In some examples, the first set of event information of the firstplurality of sets of event information may be indicative of the firstcontent item 546 (e.g., the first set of event information may comprisea content item identifier associated with the first content item 546), afirst time that the first event occurs, the first entity and/or thesecond entity. Alternatively and/or additionally, the first plurality ofsets of event information may comprise indications of a third pluralityof entities, comprising an indication of the third entity, correspondingto the third entity type (e.g., advertising-side entities). For example,the first set of event information may be indicative of the third entityassociated with the first content item 546.

At 404, a first network profile associated with the first plurality ofentities and/or the second plurality of entities may be generated basedupon the first plurality of sets of event information. In some examples,the first network profile may be indicative of event metrics associatedwith entities of the first plurality of entities and/or the secondplurality of entities, such as a rate at which events associated with aclient-side entity and an internet resource-side entity occur, and/or aquantity of events associated with a client-side entity and an internetresource-side entity.

In some examples, the first network profile is indicative of one or morefirst sets of event metrics associated with the first entity and one ormore first entities comprising the second entity. For example, the oneor more first entities may correspond to one or more internetresource-side entities of the second plurality of entities.

In some examples, a first set of event metrics of the one or more firstsets of event metrics may correspond to a measure of events associatedwith the first entity and the second entity. The events associated withthe first entity and the second entity may comprise the first event.Alternatively and/or additionally, an event associated with the firstentity and the second entity may be associated with a presentation of acontent item (e.g., an advertisement) via the first client device 500using an internet resource of the one or more first internet resourcesassociated with the second entity. Alternatively and/or additionally, anevent associated with the first entity and the second entity may beassociated with a presentation of a threshold proportion of a contentitem (e.g., an advertisement) via the first client device 500 using aninternet resource of the one or more first internet resources associatedwith the second entity. Alternatively and/or additionally, an eventassociated with the first entity and the second entity may be associatedwith a selection of a content item (e.g., an advertisement) via thefirst client device 500 using an internet resource of the one or morefirst internet resources associated with the second entity.Alternatively and/or additionally, an event associated with the firstentity and the second entity may correspond to a conversion eventassociated with a content item (e.g., an advertisement) that ispresented via the first client device 500 using an internet resource ofthe one or more first internet resources associated with the secondentity.

The first set of event metrics may be indicative of a first event rateat which events associated with the first entity and the second entityoccur, such as during the first period of time. In an example, the firstevent rate may correspond to a quantity of events associated with thefirst entity and the second entity per unit of time (e.g., per day, perweek and/or per a different unit of time). In an example, the firstevent rate may correspond to five events per day (e.g., on average, fiveevents associated with the first entity and the second entity may occurper day). Alternatively and/or additionally, the first set of eventmetrics may be indicative of a first quantity of events associated withthe first entity and the second entity, such as during the first periodof time. In an example, the first event rate may be determined basedupon a duration of the first period of time and/or the first quantity ofevents associated with the first entity and the second entity.

In some examples, the one or more first entities associated with the oneor more first sets of event metrics may comprise entities, of the secondplurality of entities, with which the first entity performed at leastone event of the first plurality of events. For example, the firstplurality of sets of event information may be analyzed based upon thefirst entity to identify the one or more first entities with which thefirst entity performed at least one event of the first plurality ofevents.

Alternatively and/or additionally, the one or more first entitiesassociated with the one or more first sets of event metrics may compriseentities, of the second plurality of entities, with which the firstentity performed events, amounting to at least a threshold quantity ofevents, of the first plurality of events. For example, the firstplurality of sets of event information may be analyzed based upon thefirst entity and the threshold quantity of events to identify the one ormore first entities with which the first entity performed events,amounting to at least the threshold quantity events, of the firstplurality of events.

In some examples, for each entity of the one or more first entities, aset of event metrics associated with the first entity and the entity maybe determined (based upon the first plurality of sets of eventinformation) and included in the first network profile.

FIG. 5F illustrates a representation 554 of the first network profile.In some examples, the representation 554 may correspond to a graph, suchas a bipartite graph. The representation 554 may comprise relationshiplines 552. A relationship line of the relationship lines 552 may bebetween a client-side entity (e.g., labeled “CLIENT 1”, “CLIENT 2”, etc.in FIG. 5F) and an internet resource-side entity (e.g., labeled“INTERNET RESOURCE 1”, “INTERNET RESOURCE 2”, etc. in FIG. 5F). Arelationship line of the relationship lines 552 between a client-sideentity and an internet resource-side entity may be indicative of atleast one event, of the first plurality of events, having occurred inassociation with the client-side entity and the internet resource-sideentity. Alternatively and/or additionally, a relationship line of therelationship lines 552 between a client-side entity and an internetresource-side entity may be indicative of events (of the first pluralityof events), amounting to at least the threshold quantity of events,having occurred in association with the client-side entity and theinternet resource-side entity.

In some examples, a relationship line of the relationship lines 552between a client-side entity and an internet resource-side entity mayhave a thickness that reflects a quantity of events having occurred inassociation with the client-side entity and the internet resource-sideentity and/or an event rate at which events associated with theclient-side entity and the internet resource-side entity occur. In anexample, a first relationship line 552A of the relationship lines 552may be between an internet resource-side entity “INTERNET RESOURCE 1”and a client-side entity “CLIENT 1”. A second relationship line 552B ofthe relationship lines 552 may be between the internet resource-sideentity “INTERNET RESOURCE 1” and a client side entity “CLIENT 2”. Athickness of the first relationship line 552A may be greater than athickness of the second relationship line 552B. Accordingly, a quantityof events having occurred in association with the internet resource-sideentity “INTERNET RESOURCE 1” and the client-side entity “CLIENT 1” maybe greater than a quantity of events having occurred in association withthe internet resource-side entity “INTERNET RESOURCE 1” and theclient-side entity “CLIENT 2”. Alternatively and/or additionally, anevent rate at which events associated with the internet resource-sideentity “INTERNET RESOURCE 1” and the client-side entity “CLIENT 1” occurmay be greater than an event rate at which events associated with theinternet resource-side entity “INTERNET RESOURCE 1” and the client-sideentity “CLIENT 2” occur.

In some examples, the first network profile may be indicative of eventmetrics associated with entities of the third plurality of entities,such as a rate at which events associated with an advertising-sideentity and a client-side entity occur, a quantity of events associatedwith an advertising-side entity and a client-side entity, a rate atwhich events associated with an advertising-side entity and an internetresource-side entity occur and/or a quantity of events associated withan advertising-side entity and an internet resource-side entity.

In some examples, the first network profile is indicative of one or moresecond sets of event metrics associated with the first entity and one ormore second entities comprising the third entity. For example, the oneor more second entities may correspond to one or more advertising-sideentities of the third plurality of entities.

In some examples, a second set of event metrics of the one or moresecond sets of event metrics may correspond to a measure of eventsassociated with the first entity and the third entity. The eventsassociated with the first entity and the third entity may comprise thefirst event. Alternatively and/or additionally, an event associated withthe first entity and the third entity may be associated with apresentation of a content item (e.g., an advertisement), associated withthe third entity, via the first client device 500 (e.g., the contentitem may correspond to the first content item 546 and/or a differentcontent item associated with the third entity). Alternatively and/oradditionally, an event associated with the first entity and the thirdentity may be associated with a presentation of a threshold proportionof a content item (e.g., an advertisement), associated with the thirdentity, via the first client device 500. Alternatively and/oradditionally, an event associated with the first entity and the thirdentity may be associated with a selection of a content item (e.g., anadvertisement), associated with the third entity, via the first clientdevice 500. Alternatively and/or additionally, an event associated withthe first entity and the second entity may correspond to a conversionevent, associated with the third entity, performed by the first clientdevice 500.

The second set of event metrics may be indicative of a second event rateat which events associated with the first entity and the third entityoccur, such as during the first period of time. In an example, thesecond event rate may correspond to a quantity of events associated withthe first entity and the third entity per unit of time (e.g., per day,per week and/or per a different unit of time). Alternatively and/oradditionally, the second set of event metrics may be indicative of asecond quantity of events associated with the first entity and the thirdentity, such as during the first period of time.

In some examples, the first network profile is indicative of one or morethird sets of event metrics associated with the second entity and one ormore third entities comprising the third entity. For example, the one ormore third entities may correspond to one or more advertising-sideentities of the third plurality of entities.

In some examples, a third set of event metrics of the one or more thirdsets of event metrics may correspond to a measure of events associatedwith the second entity and the third entity. The events associated withthe second entity and the third entity may comprise the first event.Alternatively and/or additionally, an event associated with the secondentity and the third entity may be associated with a presentation of acontent item (e.g., an advertisement), associated with the third entity,via an internet resource associated with the second entity.Alternatively and/or additionally, an event associated with the secondentity and the third entity may be associated with a presentation of athreshold proportion of a content item (e.g., an advertisement),associated with the third entity, via an internet resource associatedwith the second entity. Alternatively and/or additionally, an eventassociated with the second entity and the third entity may be associatedwith a selection of a content item (e.g., an advertisement), associatedwith the third entity, via an internet resource associated with thesecond entity. Alternatively and/or additionally, an event associatedwith the second entity and the third entity may correspond to aconversion event associated with presentation of a content item (e.g.,an advertisement), associated with the third entity, via an internetresource associated with the second entity.

The third set of event metrics may be indicative of a third event rateat which events associated with the second entity and the third entityoccur, such as during the first period of time. In an example, the thirdevent rate may correspond to a quantity of events associated with thesecond entity and the third entity per unit of time (e.g., per day, perweek and/or per a different unit of time). Alternatively and/oradditionally, the third set of event metrics may be indicative of athird quantity of events associated with the second entity and the thirdentity, such as during the first period of time.

At 406, a first plurality of representations associated with the firstplurality of entities may be generated. In some examples, the firstplurality of representations may be generated based upon the firstnetwork profile and/or the first plurality of sets of event information.A representation of the first plurality of representations (and/or eachrepresentation of the first plurality of representations) may beassociated with an entity of the first plurality of entities. Forexample, a first representation of the first plurality ofrepresentations may be associated with the first entity. In someexamples, the first representation may be generated based upon the oneor more first sets of event metrics, of the first network profile,associated with the first entity and the one or more first entities ofthe second plurality of entities. Alternatively and/or additionally, thefirst representation may be generated based upon the one or more secondsets of event metrics, of the first network profile, associated with thefirst entity and the one or more second entities of the third pluralityof entities. For example, the first representation may be generatedbased upon the one or more first sets of event metrics and/or the one ormore second sets of event metrics.

In some examples, the first plurality of representations may comprisevector representations. For example, the first representation of thefirst plurality of representations may be a first vector representation.In some examples, the first vector representation may comprise anembedding, such as a word2vec embedding and/or a different type ofembedding, generated based upon the one or more first sets of eventmetrics (and/or the one or more second sets of event metrics) using oneor more word2vec techniques and/or one or more machine learningtechniques. In some examples, the word2vec embedding may be a numericalrepresentation (e.g., at least one of a numerical vector, a numericalembedding, etc.) of the first entity and/or the one or more first setsof event metrics (and/or the one or more second sets of event metrics)associated with the first entity.

In some examples, a vector representation generation system may use atleast one of one or more dimensional reduction techniques, one or moredecomposition techniques, one or more reconstruction techniques, graphsolutions, etc. to perform dimensional reduction of the one or morefirst sets of event metrics (and/or the one or more second sets of eventmetrics) to generate the first vector representation associated with thefirst entity. For example, the one or more first sets of event metrics(and/or the one or more second sets of event metrics) may be indicativeof N entities of the second plurality of entities with which the firstentity performed events of the first plurality of events (e.g., the oneor more first sets of event metrics and/or the one or more second setsof event metrics may comprise N sets of event metrics, where each set ofevent metrics of the N sets of event metrics is associated with anentity of the N entities). As a result of performing dimensionalreduction of the one or more first sets of event metrics, the firstvector representation may be generated having M dimensions, where thequantity M of the M dimensions is less than the quantity N of the Nentities. In an example, the quantity M may be 100 and the first vectorrepresentation may correspond to a 100-dimension numerical featurevector. Other values of the quantity M are within the scope of thepresent disclosure. Parameters of the vector representation generationsystem may be adjusted and/or tuned for generating the first vectorrepresentation having varying quantities of dimensions.

At 408, a second plurality of representations associated with the secondplurality of entities may be generated. In some examples, the secondplurality of representations may be generated based upon the firstnetwork profile and/or the first plurality of sets of event information.A representation of the second plurality of representations (and/or eachrepresentation of the second plurality of representations) may beassociated with an entity of the second plurality of entities.

For example, a second representation of the second plurality ofrepresentations may be associated with the second entity. In someexamples, the second representation may be generated based upon one ormore fourth sets of event metrics, of the first network profile,associated with the second entity and one or more fourth entities of thefirst plurality of entities. The one or more fourth entities maycomprise one or more entities with which the second entity performed atleast one event of the first plurality of events. Alternatively and/oradditionally, the one or more fourth entities may comprise one or moreentities with which the second entity performed events, amounting to atleast a threshold quantity of events, of the first plurality of events.In an example, the one or more fourth entities may comprise the firstentity and/or one or more other entities of the first plurality ofentities with which the second entity performed one or more events ofthe first plurality of events. In some examples, the one or more fourthsets event metrics may comprise the first set of event metrics of theone or more first sets of event metrics and/or one or more other sets ofevent metrics associated with the one or more other entities of thefirst plurality of entities.

Alternatively and/or additionally, the second representation may begenerated based upon the one or more third sets of event metrics, of thefirst network profile, associated with the first entity and the one ormore third entities of the third plurality of entities. For example, thefirst representation may be generated based upon the one or more fourthsets of event metrics and/or the one or more third sets of eventmetrics.

In some examples, the second plurality of representations may comprisevector representations. For example, the second representation of thesecond plurality of representations may be a second vectorrepresentation. In some examples, the second vector representation maycomprise an embedding, such as a word2vec embedding and/or a differenttype of embedding, generated based upon the one or more fourth sets ofevent metrics (and/or the one or more third sets of event metrics) usingone or more word2vec techniques and/or one or more machine learningtechniques. In some examples, the word2vec embedding may be a numericalrepresentation (e.g., at least one of a numerical vector, a numericalembedding, etc.) of the second entity and/or the one or more fourth setsof event metrics (and/or the one or more third sets of event metrics)associated with the second entity.

In some examples, the vector representation generation system mayperform dimensional reduction of the one or more fourth sets of eventmetrics (and/or the one or more third sets of event metrics) to generatethe second vector representation associated with the second entity, suchas using one or more of the techniques described herein with respect togeneration the first vector representation.

FIG. 5G illustrates an exemplary scenario in which the first pluralityof representations (shown with reference number 562) and the secondplurality of representations (shown with reference number 564) aregenerated. For example, the first network profile (shown with referencenumber 558) may be input to a representation generator 560. Therepresentation generator 560 may comprise the vector representationgeneration system. The representation generator 560 may generate and/oroutput the first plurality of representations 562 and/or the secondplurality of representations 564 based upon the first network profile558.

At 410, a first plurality of clusters in the first plurality ofrepresentations may be identified. In some examples, a cluster of thefirst plurality of clusters (and/or each cluster of the first pluralityof clusters) corresponds to a set of representations of the firstplurality of representations. For example, a first cluster of the firstplurality of clusters may correspond to a first set of representationsof the first plurality of representations.

In some examples, the first set of representations may be identified asthe first cluster based upon a determination that representations of thefirst set of representations are similar to each other. Alternativelyand/or additionally, the first set of representations may be identifiedas the first cluster based upon a determination that differences betweenrepresentations of the first set of representations are less than athreshold difference. For example, one or more operations (e.g.,mathematical operations) may be performed using representations of thefirst set of representations to determine a difference between therepresentations. The difference may be compared with the thresholddifference to determine whether the difference is less than thethreshold difference.

Alternatively and/or additionally, the first plurality of clusters maybe identified using one or more clustering techniques, such as one ormore spectral clustering techniques, one or more k-means clusteringtechniques and/or one or more other clustering techniques. For example,the first plurality of representations may be analyzed using the one ormore clustering techniques to identify the first plurality of clusters.In an example where the first plurality of representations comprisesvector representations, the first set of representations may beidentified as the first cluster based upon a determination thatdistances between representations of the first set of representationsare less than a threshold distance. For example, one or more operations(e.g., mathematical operations) may be performed using representationsof the first set of representations to determine a distance between therepresentations. The distance may be compared with the thresholddistance to determine whether the distance is less than the thresholddistance.

In some examples, distances between representations of the firstplurality of representations may be determined, and a similarity datastructure (e.g., at least one of a similarity matrix, a similaritygraph, etc.) may be generated based upon the distances. Eigenvaluesand/or eigenvectors associated with the similarity data structure may bedetermined based upon the similarity data structure. Similarrepresentations of the first plurality of representations may beidentified and/or clustered using one or more clustering techniques(e.g., one or more k-means clustering techniques) based upon thesimilarity data structure, the eigenvalues and/or the eigenvectors. Thefirst set of representations of the first plurality of representationsmay be identified as the first cluster based upon a determination that adensity associated with the first set of representations exceeds a firstthreshold density. In some examples, the density may be determined basedupon the similarity data structure, the eigenvalues and/or theeigenvectors.

It may be appreciated that first generating the first plurality ofrepresentations, and then identifying the first plurality of clusters inthe first plurality of representations, provides for an improvedefficiency compared with a system that analyzes the first networkprofile 558 to identify clusters of entities and/or coalition networkswithout first generating the first plurality of representations. Forexample, attempting to analyze the network profile 558 to identifyclusters of entities without first generating the first plurality ofrepresentations may be difficult and/or inefficient (e.g.,identification of clusters of entities without first generating thefirst plurality of representations may be formulated as a dense subgraphdetection problem and/or a biclique detection problem, which arenondeterministic polynomial time (NP)-hard problems). However,generation of the first plurality of representations simplifies solvingthe problem of identifying the first plurality of clusters such that theproblem can be more efficiently solved.

At 412, a second plurality of clusters in the second plurality ofrepresentations may be identified. In some examples, a cluster of thesecond plurality of clusters (and/or each cluster of the secondplurality of clusters) corresponds to a set of representations of thesecond plurality of representations. For example, a second cluster ofthe second plurality of clusters may correspond to a second set ofrepresentations of the second plurality of representations.

In some examples, the second set of representations may be identified asthe second cluster based upon a determination that representations ofthe second set of representations are similar to each other.Alternatively and/or additionally, the second set of representations maybe identified as the second cluster based upon a determination thatdifferences between representations of the second set of representationsare less than a threshold difference. For example, one or moreoperations (e.g., mathematical operations) may be performed usingrepresentations of the second set of representations to determine adifference between the representations. The difference may be comparedwith the threshold difference to determine whether the difference isless than the threshold difference.

Alternatively and/or additionally, the second plurality of clusters maybe identified using one or more clustering techniques, such as one ormore spectral clustering techniques, one or more k-means clusteringtechniques and/or one or more other clustering techniques. For example,the second plurality of representations may be analyzed using the one ormore clustering techniques to identify the second plurality of clusters.In an example where the second plurality of representations comprisesvector representations, the second set of representations may beidentified as the second cluster based upon a determination thatdistances between representations of the second set of representationsare less than a threshold distance. For example, one or more operations(e.g., mathematical operations) may be performed using representationsof the second set of representations to determine a distance between therepresentations. The distance may be compared with the thresholddistance to determine whether the distance is less than the thresholddistance.

In some examples, distances between representations of the secondplurality of representations may be determined, and a similarity datastructure (e.g., at least one of a similarity matrix, a similaritygraph, etc.) may be generated based upon the distances. Eigenvaluesand/or eigenvectors associated with the similarity data structure may bedetermined based upon the similarity data structure. Similarrepresentations of the second plurality of representations may beidentified and/or clustered using one or more clustering techniques(e.g., one or more k-means clustering techniques) based upon thesimilarity data structure, the eigenvalues and/or the eigenvectors. Thesecond set of representations of the second plurality of representationsmay be identified as the second cluster based upon a determination thata density associated with the second set of representations exceeds asecond threshold density. In some examples, the density may bedetermined based upon the similarity data structure, the eigenvaluesand/or the eigenvectors.

At 414, the first network profile may be analyzed to determine that afirst set of entities associated with the first cluster and a second setof entities associated with the second cluster are related. In someexamples, the first set of entities may be associated with the first setof representations corresponding to the first cluster. Alternativelyand/or additionally, the second set of entities may be associated withthe second set of representations corresponding to the second cluster.

In some examples, the determination that the first set of entities andthe second set of entities are related is based upon a determinationthat one or more first events of the first plurality of events areassociated with the first set of entities and the second set ofentities. For example, each event of the one or more first events may beperformed by an entity of the first set of entities and an entity of thesecond set of entities. In an example, an event of the one or more firstevents may correspond to a presentation of a content item via a clientdevice associated with an entity of the first set of entities(corresponding to the first cluster) using an internet resourceassociated with an entity of the second set of entities (correspondingto the second cluster). Alternatively and/or additionally, an event ofthe one or more first events may correspond to a presentation of athreshold proportion of a content item via a client device associatedwith an entity of the first set of entities (corresponding to the firstcluster) using an internet resource associated with an entity of thesecond set of entities (corresponding to the second cluster).Alternatively and/or additionally, an event of the one or more firstevents may correspond to a selection of a content item via a clientdevice associated with an entity of the first set of entities(corresponding to the first cluster) using an internet resourceassociated with an entity of the second set of entities (correspondingto the second cluster). Alternatively and/or additionally, an event ofthe one or more first events may correspond to a conversion eventassociated with a presentation of a content item via a client deviceassociated with an entity of the first set of entities (corresponding tothe first cluster) using an internet resource associated with an entityof the second set of entities (corresponding to the second cluster).

In some examples, the first network profile may be analyzed based uponthe first set of entities and the second set of entities to determine afourth quantity of events associated with the first set of entities andthe second set of entities (e.g., the fourth quantity of events maycorrespond to a quantity of events of the one or more first events). Insome examples, the determination that the first set of entities and thesecond set of entities are related is based upon a determination thatthe fourth quantity of events exceeds a threshold quantity of events.

In some examples, the first network profile may be analyzed based uponthe one or more first events, the first set of entities and/or thesecond set of entities to determine a first quantity of entitiesassociated with the one or more first events. In an example, it may bedetermined that the one or more first events are associated with one ormore fifth entities of the first set of entities and one or more sixthentities of the second set of entities. The first quantity of entitiesassociated with the one or more first events may be determined basedupon the one or more fifth entities and/or the one or more sixthentities (e.g., the first quantity of entities may be determined basedupon a quantity of entities of the one or more fifth entities and/or aquantity of entities of the one or more sixth entities). In someexamples, the determination that the first set of entities and thesecond set of entities are related is based upon a determination thatthe first quantity of entities exceeds a threshold quantity of entities.Alternatively and/or additionally, the determination that the first setof entities and the second set of entities are related may be based upona determination that the first quantity of entities exceeds a thresholdproportion of the first set of entities and/or the second set ofentities.

At 416, a first coalition network associated with fraudulent activitymay be determined based upon the determination that the first set ofentities and the second set of entities are related. For example, thefirst set of entities and the second set of entities may be identifiedand/or recognized as being a network of entities used for performingfraudulent activity based upon the determination that the first set ofentities and the second set of entities are related. In some examples,the first coalition network may correspond to a network of entities,comprising at least some of the first set of entities and at least someof the second set of entities, used to perform fraudulent activity, suchas advertising fraud. In some examples, the first coalition network maycomprise all the first set of entities and/or all of the second set ofentities. Alternatively and/or additionally, the first coalition networkmay comprise a subset of the first set of entities and/or a subset ofthe second set of entities. In some examples, merely entities of thefirst set of entities that are related to entities of the second set ofentities may be included in the first coalition network. Alternativelyand/or additionally, merely entities of the second set of entities thatare related to entities of the first set of entities may be included inthe first coalition network. For example, merely entities, of the firstset of entities and the second set of entities, that are associated withthe one or more first events, may be included in the first coalitionnetwork.

In some examples, one or more other coalition networks associated withfraudulent activity may be determined, such as using one or more of thetechniques described herein with respect to identifying the firstcoalition network. For example, analysis of the first network profilemay be performed (iteratively, for example), using one or more of thetechniques described herein, for each cluster of the first plurality ofclusters and/or each cluster of the second plurality of clusters todetermine whether entities associated with a cluster of the firstplurality of clusters are related to entities associated with a clusterof the second plurality of clusters. A coalition network may beidentified based upon a determination that entities associated with acluster of the first plurality of clusters are related to entitiesassociated with a cluster of the second plurality of clusters.

FIG. 5H illustrates an exemplary scenario in which one or more coalitionnetworks 590 are identified based upon the first plurality ofrepresentations (shown with reference number 562) and the secondplurality of representations (shown with reference number 564). In someexamples, one or more first cluster identification operations 572 may beperformed using the first plurality of representations 562 to identifythe first plurality of clusters in a first embedding space 570. Forexample, the first plurality of clusters may comprise the first cluster(shown with reference number 576), a third cluster 574 and/or a fourthcluster 578.

In some examples, one or more second cluster identification operations582 may be performed using the second plurality of representations 564to identify the second plurality of clusters in a second embedding space580. For example, the second plurality of clusters may comprise thesecond cluster (shown with reference number 584), a fifth cluster 586and/or a sixth cluster 588.

In some examples, the first network profile (shown with reference number558), information associated with the first plurality of clusters and/orinformation associated with the second plurality of clusters may beinput to a coalition network determiner 592. In some examples, for eachcluster of the first plurality of clusters and/or the second pluralityof clusters, the first network profile 558 may be analyzed to determinewhether entities associated with a cluster of the first plurality ofclusters are related to entities associated with a cluster of the secondplurality of clusters. A coalition network of the one or more coalitionnetworks 590 may be identified based upon a determination that entitiesassociated with a cluster of the first plurality of clusters are relatedto entities associated with a cluster of the second plurality ofclusters.

It may be appreciated that first identifying the first plurality ofclusters and the second plurality of clusters, then analyzing the firstnetwork profile 558 to identify the one or more coalition networks 590based upon the first plurality of clusters and the second plurality ofclusters, provides for a reduced target cardinality and an improvedefficiency compared with a system that analyzes the first networkprofile 558 to identify coalition networks without first identifying thefirst plurality of clusters and the second plurality of clusters. Forexample, attempting to analyze the network profile 558, the firstplurality of representations 562 and/or the second plurality ofrepresentations 564 to identify coalition networks without firstidentifying the first plurality of clusters and/or the second pluralityof clusters may be difficult and/or inefficient (e.g., identification ofcoalition networks without first identifying the first plurality ofclusters and/or the second plurality of clusters may be an NP-hardproblem). However, identification of the first plurality of clusters andthe second plurality of clusters, and using the first plurality ofclusters and the second plurality of clusters for identifying coalitionnetworks simplifies solving the problem of identifying the coalitionnetworks such that the problem can be more efficiently solved.

In some examples, rather than (and/or in addition to) analyzing thefirst plurality of representations and the second plurality ofrepresentations separately to identify the first plurality of clustersand the second plurality of clusters, a third plurality ofrepresentations, comprising the first plurality of representations andthe second plurality of representations, may be analyzed to identify athird plurality of clusters. For example, a third cluster of the thirdplurality of clusters may correspond to a third set of representationscomprising one or more representations of the first plurality ofrepresentations (associated with client-side entities) and/or one ormore representations of the second plurality of representations(associated with internet resource-side entities).

In some examples, the third set of representations may be identified asthe third cluster based upon a determination that representations of thethird set of representations are similar to each other. Alternativelyand/or additionally, the third set of representations may be identifiedas the third cluster based upon a determination that differences betweenrepresentations of the third set of representations are less than athreshold difference. For example, one or more operations (e.g.,mathematical operations) may be performed using representations of thethird set of representations to determine a difference between therepresentations. The difference may be compared with the thresholddifference to determine whether the difference is less than thethreshold difference.

Alternatively and/or additionally, the third plurality of clusters maybe identified using one or more clustering techniques, such as one ormore spectral clustering techniques, one or more k-means clusteringtechniques and/or one or more other clustering techniques. For example,the third plurality of representations may be analyzed using the one ormore clustering techniques to identify the third plurality of clusters.In an example where the third plurality of representations comprisesvector representations, the third set of representations may beidentified as the third cluster based upon a determination thatdistances between representations of the third set of representationsare less than a threshold distance. For example, one or more operations(e.g., mathematical operations) may be performed using representationsof the third set of representations to determine a distance between therepresentations. The distance may be compared with the thresholddistance to determine whether the distance is less than the thresholddistance.

In some examples, distances between representations of the thirdplurality of representations may be determined, and a similarity datastructure (e.g., at least one of a similarity matrix, a similaritygraph, etc.) may be generated based upon the distances. Eigenvaluesand/or eigenvectors associated with the similarity data structure may bedetermined based upon the similarity data structure. Similarrepresentations of the third plurality of representations may beidentified and/or clustered using one or more clustering techniques(e.g., one or more k-means clustering techniques) based upon thesimilarity data structure, the eigenvalues and/or the eigenvectors. Thethird set of representations of the third plurality of representationsmay be included in the third cluster based upon a determination that adensity associated with the third set of representations exceeds a thirdthreshold density. In some examples, the density may be determined basedupon the similarity data structure, the eigenvalues and/or theeigenvectors.

In some examples, one or more coalition networks may be identified basedupon the third plurality of clusters. In an example, a third coalitionnetwork may be identified based upon a third set of entities associatedwith the third set of representations corresponding to the thirdcluster. For example, the third set of entities may be identified and/orrecognized as being a network of entities used for performing fraudulentactivity based upon the determination that the third set of entities areassociated with the third set of representations corresponding to thethird cluster.

An embodiment of identifying coalition networks is illustrated by anexample method 600 of FIG. 6. A content system for providing contentitems via client devices, such as the content system described withrespect to the method 400 of FIG. 4, may be provided. At 602, a firstplurality of sets of event information associated with a first pluralityof events may be identified. The first plurality of events may beassociated with a first plurality of entities corresponding to a firstentity type and a second plurality of entities corresponding to a secondentity type. In some examples, the first plurality of events maycorrespond to events that occur within a first period of time.

In some examples, the first plurality of entities corresponds toclient-side (and/or user-side) entities. For example, an entity of thefirst plurality of entities may be associated with a client device. Thefirst type of entity may correspond to at least one of a client device,a device identifier associated with a device, an IP address associatedwith a device, a carrier identifier indicative of carrier informationassociated with a device, a user identifier (e.g., at least one of ausername, an email address, a user account identifier, etc.) associatedwith a device, a browser cookie, etc.

In some examples, the second plurality of entities corresponds tointernet resource-side (and/or publisher-side) entities. For example, anentity of the second plurality of entities may be associated with aninternet resource, such as at least one of a web page, a website, anapplication (e.g., a client application, a mobile application, aplatform, etc.). The second type of entity may correspond to at leastone of an internet resource, an internet resource identifier associatedwith an internet resource, a host device associated with an internetresource (e.g., the host device may comprise one or more computingdevices, storage and/or a network configured to host the internetresource), a host identifier of the host device, a domain (e.g., adomain name, a top-level domain, etc.) associated with an internetresource, an application identifier associated with an application, apublisher identifier associated with a publisher of an internetresource, etc.

In some examples, an event of the first plurality of events (and/or eachevent of the first plurality of events) may correspond to activityperformed by an entity of the first plurality of entities and/or anentity of the second plurality of entities. In an example, an event ofthe first plurality of events (and/or each event of the first pluralityof events) may correspond to presentation of a content item (e.g.,presentation of an advertisement and/or an advertisement impression), aselection of the content item (e.g., an advertisement click), and/or aconversion event associated with the content item, where the contentitem may be provided by the content system.

A first set of event information of the first plurality of sets of eventinformation may be associated with a first event of the first pluralityof events. The first set of event information may be indicative of afirst entity (e.g., a client-side entity), of the first plurality ofentities, associated with the first event. The first set of eventinformation may be indicative of a second entity (e.g., an internetresource-side entity), of the second plurality of entities, associatedwith the first event. Examples of the first event are illustrated inFIGS. 5A-5E and described in the foregoing description of FIGS. 5A-5E.In some examples, the first entity may be associated with a first clientdevice (such as the first client device 500 illustrated in FIGS. 5A-5E)and/or the second entity may be associated with one or more firstinternet resources (such as the one or more first internet resourcescomprising the fourth web page 544 illustrated in FIG. 5E).

In some examples, the first event may correspond to a presentation of acontent item via the first client device using an internet resource ofthe one or more first internet resources. Alternatively and/oradditionally, the first event may correspond to a presentation of athreshold proportion of a content item via the first client device usingan internet resource of the one or more first internet resources.Alternatively and/or additionally, the first event may correspond to aselection of a content item via the first client device using aninternet resource of the one or more first internet resources.Alternatively and/or additionally, the first event may correspond to aconversion event (such as described in the foregoing description)associated with a content item that is presented via the first clientdevice using an internet resource of the one or more first internetresources.

In some examples, the first plurality of sets of event information maycomprise indications of a third plurality of entities corresponding to athird entity type (e.g., advertising-side entities), such as describedwith respect to the method 400 of FIG. 4, where a set of eventinformation of the first plurality of sets of event informationcomprises an indication of an entity of the first plurality of entitiesassociated with an event, an indication of an entity of the secondplurality of entities associated with the event and/or an indication ofan entity of the third plurality of entities associated with the event.

At 604, a first network profile associated with the first plurality ofentities and/or the second plurality of entities may be generated basedupon the first plurality of sets of event information. In some examples,the first network profile may be indicative of event metrics associatedwith entities of the first plurality of entities and/or the secondplurality of entities, such as a rate at which events associated with aclient-side entity and an internet resource-side entity occur, and/or aquantity of events associated with a client-side entity and an internetresource-side entity.

In some examples, the first network profile is indicative of one or morefirst sets of event metrics associated with the second entity and afirst set of entities comprising the second entity. For example, thefirst set of entities may correspond to one or more client-side entitiesof the first plurality of entities.

In some examples, a first set of event metrics of the one or more firstsets of event metrics may correspond to a measure of events associatedwith the first entity and the second entity, such as described withrespect to the method 400 of FIG. 4.

In some examples, the first set of entities associated with the one ormore first sets of event metrics may comprise entities, of the firstplurality of entities, with which the second entity performed at leastone event of the first plurality of events. For example, the firstplurality of sets of event information may be analyzed based upon thesecond entity to identify the first set of entities with which thesecond entity performed at least one event of the first plurality ofevents.

Alternatively and/or additionally, the first set of entities associatedwith the one or more first sets of event metrics may comprise entities,of the first plurality of entities, with which the second entityperformed events, amounting to at least a threshold quantity of events,of the first plurality of events. For example, the first plurality ofsets of event information may be analyzed based upon the second entityand the threshold quantity of events to identify the first set ofentities with which the second entity performed events, amounting to atleast the threshold quantity events, of the first plurality of events.

For each entity of the first set of entities, a set of event metricsassociated with the second entity and the entity may be determined(based upon the first plurality of sets of event information) andincluded in the first network profile.

The first network profile may be represented by a graph (e.g., abipartite graph), such as the representation 554 illustrated in FIG. 5Fand described with respect to the method 400 of FIG. 4.

In some examples, the first network profile may be indicative of eventmetrics associated with entities of the third plurality of entities,such as a rate at which events associated with an advertising-sideentity and a client-side entity occur, a quantity of events associatedwith an advertising-side entity and a client-side entity, a rate atwhich events associated with an advertising-side entity and an internetresource-side entity occur and/or a quantity of events associated withan advertising-side entity and an internet resource-side entity.

In some examples, a first iterative process may be performed to identifyone or more coalition networks associated with fraudulent activity fromamongst the first plurality of entities and/or the second plurality ofentities. The first iterative process is described with respect to acts606-612 of the method 600.

At 606, the first network profile may be analyzed to identify the firstset of entities, of the first plurality of entities, that are related tothe second entity. In some examples, the identification of the first setof entities that are related to the second entity is performed basedupon a determination that each entity of the first set of entities isassociated with one or more events, of the first plurality of events,associated with the second entity. For example, the first entity of thefirst plurality of entities may be included in the first set of entitiesbased upon a determination that one or more events of the firstplurality of events are performed by the first entity and the secondentity.

Alternatively and/or additionally, the identification of the first setof entities that are related to the second entity may be performed basedupon a determination that each entity of the first set of entities isassociated with one or more events, exceeding a first threshold quantityof events, associated with the second entity. For example, the firstentity of the first plurality of entities may be included in the firstset of entities based upon a determination that one or more events ofthe first plurality of events are performed by the first entity and thesecond entity and/or that the one or more events exceed the firstthreshold quantity of events.

FIGS. 7A-7B illustrate examples of a system 701 for performing the firstiterative process, described with respect to the method 600 of FIG. 6.FIG. 7A illustrates performance of some of the first iterative process.For example, the first network profile may be analyzed to identify afirst set of entities (shown with reference number 704) that are relatedto the second entity (shown with reference number 702).

At 608, the first network profile may be analyzed to identify a secondset of entities, of the second plurality of entities, that are relatedto the first set of entities.

In some examples, the identification of the second set of entities thatare related to the first set of entities is performed based upon adetermination that each entity of the second set of entities isassociated with one or more events of the first plurality of events,where the one or more events comprise at least one event associated witheach entity of the first set of entities. For example, a third entitymay be included in the second set of entities based upon a determinationthat each entity of the first set of entities performed at least oneevent of the first plurality of events with the third entity.

Alternatively and/or additionally, the identification of the second setof entities that are related to the first set of entities may beperformed based upon a determination that each entity of the second setof entities is associated with events of the first plurality of events,where the events comprise one or more events, amounting to at least asecond threshold quantity of events, associated with each entity of thefirst set of entities. For example, the third entity may be included inthe second set of entities based upon a determination that each entityof the first set of entities performed one or more events, amounting toat least the second threshold quantity of events, with the third entity.

Alternatively and/or additionally, the identification of the second setof entities that are related to the first set of entities may beperformed based upon a determination that each entity of the second setof entities is associated with one or more events of the first pluralityof events, where the one or more events comprise at least one eventassociated with each entity of a first threshold proportion of the firstset of entities. For example, the third entity may be included in thesecond set of entities based upon a determination that each entity ofone or more entities of the first set of entities performed at least oneevent of the first plurality of events with the third entity, where theone or more entities make up at least the first threshold proportion ofthe first set of entities. In an example where the first thresholdproportion corresponds to 80% and the first set of entities has 10entities, the third entity may be included in the second set of entitiesbased upon a determination that the one or more entities, with which thethird entity performed at least one event of the first plurality ofevents, corresponds to at least 8 entities (e.g., 80% of the 10 entitiesof the first set of entities).

Alternatively and/or additionally, the identification of the second setof entities that are related to the first set of entities may beperformed based upon a determination that each entity of the second setof entities is associated with events of the first plurality of events,where the events comprise one or more events, amounting to at least thesecond threshold quantity of events, associated with each entity of thefirst threshold proportion of the first set of entities. For example,the third entity may be included in the second set of entities basedupon a determination that each entity of one or more entities of thefirst set of entities performed one or more events, amounting to atleast the second threshold quantity of events, with the third entity,where the one or more entities make up at least the first thresholdproportion of the first set of entities.

With respect to FIG. 7A, the first network profile may be analyzed toidentify the second set of entities (shown with reference number 706)that are related to the first set of entities 704. For example, aplurality of entities (shown in column “tempL1” of FIG. 7A) may beidentified, where each entity of the plurality of entities performed atleast one event with at least one entity of the first set of entities704. The second set of entities 706 may be selected from the pluralityof entities based upon a determination that each entity of the secondset of entities 706 performed one or more events, of the first pluralityof events, with each entity of the first set of entities 704.Alternatively and/or additionally, the second set of entities 706 may beselected from the plurality of entities based upon a determination thateach entity of the second set of entities 706 performed one or moreevents, of the first plurality of events, with each entity of one ormore entities of the first set of entities 704, where the one or moreentities make up at least the first threshold proportion of the firstset of entities 706.

At 610, the first network profile may be analyzed to identify a thirdset of entities, of the first plurality of entities, that are related tothe second set of entities.

In some examples, the identification of the third set of entities thatare related to the second set of entities is performed based upon adetermination that each entity of the third set of entities isassociated with one or more events of the first plurality of events,where the one or more events comprise at least one event associated witheach entity of the second set of entities. For example, a fourth entitymay be included in the third set of entities based upon a determinationthat each entity of the second set of entities performed at least oneevent of the first plurality of events with the fourth entity.

Alternatively and/or additionally, the identification of the third setof entities that are related to the second set of entities may beperformed based upon a determination that each entity of the third setof entities is associated with events of the first plurality of events,where the events comprise one or more events, amounting to at least athird threshold quantity of events, associated with each entity of thesecond set of entities. For example, the fourth entity may be includedin the third set of entities based upon a determination that each entityof the second set of entities performed one or more events, amounting toat least the third threshold quantity of events, with the fourth entity.

Alternatively and/or additionally, the identification of the third setof entities that are related to the second set of entities may beperformed based upon a determination that each entity of the third setof entities is associated with one or more events of the first pluralityof events, where the one or more events comprise at least one eventassociated with each entity of a second threshold proportion of thesecond set of entities. For example, the fourth entity may be includedin the third set of entities based upon a determination that each entityof one or more entities of the second set of entities performed at leastone event of the first plurality of events with the fourth entity, wherethe one or more entities make up at least the second thresholdproportion of the second set of entities.

Alternatively and/or additionally, the identification of the third setof entities that are related to the second set of entities may beperformed based upon a determination that each entity of the third setof entities is associated with events of the first plurality of events,where the events comprise one or more events, amounting to at least thethird threshold quantity of events, associated with each entity of thesecond threshold proportion of the second set of entities. For example,the fourth entity may be included in the third set of entities basedupon a determination that each entity of one or more entities of thesecond set of entities performed one or more events, amounting to atleast the third threshold quantity of events, with the fourth entity,where the one or more entities make up at least the second thresholdproportion of the second set of entities.

With respect to FIG. 7A, the first network profile may be analyzed toidentify the third set of entities (shown with reference number 708)that are related to the second set of entities 706. For example, aplurality of entities (shown in column “tempR1” of FIG. 7A) may beidentified, where each entity of the plurality of entities performed atleast one event with at least one entity of the second set of entities706. The third set of entities 708 may be selected from the plurality ofentities based upon a determination that each entity of the third set ofentities 708 performed one or more events, of the first plurality ofevents, with each entity of the second set of entities 706.Alternatively and/or additionally, the third set of entities 708 may beselected from the plurality of entities based upon a determination thateach entity of the third set of entities 708 performed one or moreevents, of the first plurality of events, with each entity of one ormore entities of the second set of entities 706, where the one or moreentities make up at least the first threshold proportion of the secondset of entities 706.

At 612, multiple iterations may be performed. An iteration of themultiple iterations may comprise at least one part of two parts. A firstpart of the two parts comprises analyzing the first network profile toidentify a first output set of entities, of the second plurality ofentities, that are related to a first input set of entities. A secondpart of the two parts comprises analyzing the first network profile toidentify a second output set of entities, of the first plurality ofentities, that are related to the first output set of entities.

In some examples, for an initial iteration of the multiple iterations,the first input set of entities corresponds to the third set ofentities. For an iteration, of the multiple iterations, following theinitial iteration, the first input set of entities corresponds to thesecond output set of entities identified in a preceding iteration of themultiple iterations. For example, for a second iteration of the multipleiterations that follows (e.g., directly follows) the initial iteration,the first input set of entities corresponds to the second output set ofentities identified in the initial iteration of the multiple iterations.Similarly, for a third iteration of the multiple iterations that follows(e.g., directly follows) the second iteration, the first input set ofentities corresponds to the second output set of entities identified inthe second iteration of the multiple iterations.

In some examples, for the first part of an iteration of the multipleiterations, the identification of the first output set of entities thatare related to the first input set of entities is performed based upon adetermination that each entity of the first output set of entities isassociated with one or more events of the first plurality of events,where the one or more events comprise at least one event associated witheach entity of the first input set of entities. For example, a fifthentity may be included in the first output set of entities based upon adetermination that each entity of the first input set of entitiesperformed at least one event of the first plurality of events with thefifth entity.

Alternatively and/or additionally, the identification of the firstoutput set of entities that are related to the first input set ofentities may be performed based upon a determination that each entity ofthe first output set of entities is associated with events of the firstplurality of events, where the events comprise one or more events,amounting to at least a fourth threshold quantity of events, associatedwith each entity of the first input set of entities. For example, afifth entity may be included in the first output set of entities basedupon a determination that each entity of the first input set of entitiesperformed one or more events, amounting to at least the fourth thresholdquantity of events, with the fifth entity. In some examples, the fourththreshold quantity of events may vary across iterations of the multipleiterations. For example, the fourth threshold quantity of events usedfor performing an iteration of the multiple iterations may be differentthan the fourth threshold quantity of events used for performing adifferent iteration of the multiple iterations.

Alternatively and/or additionally, the identification of the firstoutput set of entities that are related to the first input set ofentities may be performed based upon a determination that each entity ofthe first output set of entities is associated with one or more eventsof the first plurality of events, where the one or more events compriseat least one event associated with each entity of a third thresholdproportion of the first input set of entities. For example, the fifthentity may be included in the first output set of entities based upon adetermination that each entity of one or more entities of the firstinput set of entities performed at least one event of the firstplurality of events with the fifth entity, where the one or moreentities make up at least the third threshold proportion of the firstinput set of entities. In some examples, the third threshold proportionmay vary across iterations of the multiple iterations. For example, thethird threshold proportion used for performing an iteration of themultiple iterations may be different than the third threshold proportionused for performing a different iteration of the multiple iterations.

Alternatively and/or additionally, the identification of the firstoutput set of entities that are related to the first input set ofentities may be performed based upon a determination that each entity ofthe first output set of entities is associated with events of the firstplurality of events, where the events comprise one or more events,amounting to at least the fourth threshold quantity of events,associated with each entity of the third threshold proportion of thefirst input set of entities. For example, the fifth entity may beincluded in the first output set of entities based upon a determinationthat each entity of one or more entities of the first input set ofentities performed one or more events, amounting to at least the fourththreshold quantity of events, with the fifth entity, where the one ormore entities make up at least the third threshold proportion of thefirst input set of entities.

In some examples, for the second part of an iteration of the multipleiterations, the identification of the second output set of entities thatare related to the first output set of entities is performed based upona determination that each entity of the second output set of entities isassociated with one or more events of the first plurality of events,where the one or more events comprise at least one event associated witheach entity of the first output set of entities. For example, a sixthentity may be included in the second output set of entities based upon adetermination that each entity of the first output set of entitiesperformed at least one event of the first plurality of events with thesixth entity.

Alternatively and/or additionally, the identification of the secondoutput set of entities that are related to the first output set ofentities may be performed based upon a determination that each entity ofthe second output set of entities is associated with events of the firstplurality of events, where the events comprise one or more events,amounting to at least a fifth threshold quantity of events, associatedwith each entity of the first output set of entities. For example, asixth entity may be included in the second output set of entities basedupon a determination that each entity of the first output set ofentities performed one or more events, amounting to at least the fifththreshold quantity of events, with the sixth entity. In some examples,the fifth threshold quantity of events may vary across iterations of themultiple iterations. For example, the fifth threshold quantity of eventsused for performing an iteration of the multiple iterations may bedifferent than the fifth threshold quantity of events used forperforming a different iteration of the multiple iterations.

Alternatively and/or additionally, the identification of the secondoutput set of entities that are related to the first output set ofentities may be performed based upon a determination that each entity ofthe second output set of entities is associated with one or more eventsof the first plurality of events, where the one or more events compriseat least one event associated with each entity of a fourth thresholdproportion of the first output set of entities. For example, the sixthentity may be included in the second output set of entities based upon adetermination that each entity of one or more entities of the firstoutput set of entities performed at least one event of the firstplurality of events with the sixth entity, where the one or moreentities make up at least the fourth threshold proportion of the firstoutput set of entities. In some examples, the fourth thresholdproportion may vary across iterations of the multiple iterations. Forexample, the fourth threshold proportion used for performing aniteration of the multiple iterations may be different than the fourththreshold proportion used for performing a different iteration of themultiple iterations.

Alternatively and/or additionally, the identification of the secondoutput set of entities that are related to the first output set ofentities may be performed based upon a determination that each entity ofthe second output set of entities is associated with events of the firstplurality of events, where the events comprise one or more events,amounting to at least the fifth threshold quantity of events, associatedwith each entity of the fourth threshold proportion of the first outputset of entities. For example, the sixth entity may be included in thesecond output set of entities based upon a determination that eachentity of one or more entities of the first output set of entitiesperformed one or more events, amounting to at least the fifth thresholdquantity of events, with the sixth entity, where the one or moreentities make up at least the fourth threshold proportion of the firstoutput set of entities.

FIG. 7B illustrates performance of two iterations of the multipleiterations (shown with reference number 712 in FIG. 7B). In someexamples, the initial iteration (shown as “ITERATION 1” in FIG. 7B) ofthe multiple iterations 712 is performed, where the first input set ofentities of the initial iteration corresponds to the third set ofentities 708. In some examples, using one or more of the techniquespresented herein, the first network profile may be analyzed to identifythe first output set of entities 714 of the initial iteration that arerelated to the third set of entities 708. Alternatively and/oradditionally, the first network profile may be analyzed to identify thesecond output set of entities 716 of the initial iteration that arerelated to the first output set of entities 714 of the initialiteration.

In some examples, a subsequent iteration (shown as “ITERATION 2” in FIG.7B) of the multiple iterations 712 is performed, where the first inputset of entities of the subsequent iteration corresponds to the secondoutput set of entities 716 identified in the initial iteration. Thesubsequent iteration may follow (e.g., directly follow) the initialiteration. In some examples, using one or more of the techniquespresented herein, the first network profile may be analyzed to identifythe first output set of entities 718 of the subsequent iteration thatare related to the second output set of entities 716 of the initialiteration. Alternatively and/or additionally, the first network profilemay be analyzed to identify the second output set of entities 720 of thesubsequent iteration that are related to the first output set ofentities 718 of the subsequent iteration.

In some examples, the multiple iterations are performed until at leastone of a difference between the first output set of entities identifiedin a fourth iteration of the multiple iterations and the first outputset of entities identified in a fifth iteration of the multipleiterations does not exceed a first threshold difference, or a differencebetween the second output set of entities identified in a sixthiteration of the multiple iterations and the second output set ofentities identified in a seventh iteration of the multiple iterationsdoes not exceed a second threshold difference. Alternatively and/oradditionally, the multiple iterations may be performed until a maximumnumber of iterations are performed.

In some examples, for a current iteration of the multiple iterations,responsive to performing the first part of the current iteration, thefirst output set of entities identified in the first part of the currentiteration (referred to as “first output entities 1” in the followingexamples) may be compared with the first output set of entitiesidentified in a preceding iteration (referred to as “first outputentities 2” in the following examples) to determine a difference betweenthe first output entities 1 and the first output entities 2. Thepreceding iteration may correspond to an iteration that precedes (e.g.,directly precedes and/or does not directly precede) the currentiteration. Responsive to a determination that the difference exceeds thefirst threshold difference, the second part of the current iteration maybe performed and/or one or more further iterations of the multipleiterations may be performed. Alternatively and/or additionally,responsive to a determination that the difference does not exceed thefirst threshold difference, the second part of the current iteration maynot be performed and/or the multiple iterations may stop beingperformed.

In some examples, the difference may correspond to a difference inentities between the first output entities 1 and the first outputentities 2. For example, the difference may correspond to the firstoutput entities 1 comprising one or more entities that are not comprisedin the first output entities 2. Alternatively and/or additionally, thedifference may correspond to the first output entities 2 comprising oneor more entities that are not comprised in the first output entities 1.

In a first example, the first threshold difference corresponds to zerodifference between the first output entities 1 and the first outputentities 2. Accordingly, in the first example, it may be determined thatthe difference does not exceed the first threshold difference if eachentity comprised in the first output entities 1 is also comprised in thefirst output entities 2 and/or if each entity comprised in the firstoutput entities 2 is also comprised in the first output entities 1.

In a second example, the first threshold difference corresponds to athreshold quantity of entities that are comprised in the first outputentities 1 but not comprised in the first output entities 2.Accordingly, in the second example, it may be determined that thedifference does not exceed the first threshold difference if one or moreentities comprised in the first output entities 1 are not comprised inthe first output entities 2 and a quantity of entities of the one ormore entities does not exceed the threshold quantity of entities.

In a third example, the first threshold difference corresponds to athreshold quantity of entities that are comprised in the first outputentities 2 but not comprised in the first output entities 1.Accordingly, in the third example, it may be determined that thedifference does not exceed the first threshold difference if one or moreentities comprised in the first output entities 2 are not comprised inthe first output entities 1 and a quantity of entities of the one ormore entities does not exceed the threshold quantity of entities.

In some examples, for a current iteration of the multiple iterations,responsive to performing the second part of the current iteration, thesecond output set of entities identified in the second part of thecurrent iteration (referred to as “second output entities 1” in thefollowing examples) may be compared with the second output set ofentities identified in a preceding iteration (referred to as “secondoutput entities 2” in the following examples) to determine a differencebetween the second output entities 1 and the second output entities 2.The preceding iteration may correspond to an iteration that precedes(e.g., directly precedes and/or does not directly precede) the currentiteration. Responsive to a determination that the difference exceeds thesecond threshold difference, one or more further iterations of themultiple iterations may be performed. Alternatively and/or additionally,responsive to a determination that the difference does not exceed thesecond threshold difference, one or more further iterations of themultiple iterations may not be performed and/or the multiple iterationsmay stop being performed.

In some examples, the difference may correspond to a difference inentities between the second output entities 1 and the second outputentities 2. For example, the difference may correspond to the secondoutput entities 1 comprising one or more entities that are not comprisedin the second output entities 2. Alternatively and/or additionally, thedifference may correspond to the second output entities 2 comprising oneor more entities that are not comprised in the second output entities 1.

In a first example, the second threshold difference corresponds to zerodifference between the second output entities 1 and the second outputentities 2. Accordingly, in the first example, it may be determined thatthe difference does not exceed the second threshold difference if eachentity comprised in the second output entities 1 is also comprised inthe second output entities 2 and/or if each entity comprised in thesecond output entities 2 is also comprised in the second output entities1.

In a second example, the second threshold difference corresponds to athreshold quantity of entities that are comprised in the second outputentities 1 but not comprised in the second output entities 2.Accordingly, in the second example, it may be determined that thedifference does not exceed the second threshold difference if one ormore entities comprised in the second output entities 1 are notcomprised in the second output entities 2 and a quantity of entities ofthe one or more entities does not exceed the threshold quantity ofentities.

In a third example, the second threshold difference corresponds to athreshold quantity of entities that are comprised in the second outputentities 2 but not comprised in the second output entities 1.Accordingly, in the third example, it may be determined that thedifference does not exceed the second threshold difference if one ormore entities comprised in the second output entities 2 are notcomprised in the second output entities 1 and a quantity of entities ofthe one or more entities does not exceed the threshold quantity ofentities.

It may be appreciated that rather than performing more than oneiteration, merely a single iteration (such as merely the initialiteration) of the multiple iterations may be performed. For example,performance of the multiple iterations may comprise performance of anynumber of iterations, such as 1 iteration and/or more than 1 iteration.

At 614, a first coalition network associated with fraudulent activitymay be determined based upon a fourth set of entities identified in thefourth iteration, the fifth iteration, the sixth iteration, the seventhiteration and/or one or more other iterations of the multipleiterations. For example, the fourth set of entities may compriseentities (e.g., the second output set of entities), of the firstplurality of entities, identified in one or more first iterations of themultiple iterations. In some examples, the one or more first iterationsmay comprise one, some and/or all of the multiple iterations. In anexample, the one or more first iterations may comprise one or more lastperformed iterations of the multiple iterations. Alternatively and/oradditionally, the fourth set of entities may comprise entities (e.g.,the first output set of entities), of the second plurality of entities,identified in one or more second iterations of the multiple iterations.In some examples, the one or more second iterations may comprise one,some and/or all of the multiple iterations. In an example, the one ormore second iterations may comprise one or more last performediterations of the multiple iterations. The fourth set of entities may beidentified and/or recognized as being a network of entities used forperforming fraudulent activity based upon the identification of thefourth set of entities in the multiple iterations performed in the firstiterative process.

In some examples, the first coalition network may comprise all entitiesof the fourth set of entities. Alternatively and/or additionally, thefirst coalition network may comprise a subset of entities of the fourthset of entities. In some examples, one or more entities of the fourthset of entities may be excluded from the first coalition network (e.g.,the one or more entities may not be included in the first coalitionnetwork). For example, an entity of the fourth set of entities may beexcluded from the first coalition network based upon a determinationthat the entity is included in a list of non-fraudulent entities. Forexample, the list of non-fraudulent entities may be indicative ofentities that are not associated with fraudulent activity, such asentities associated with internet resources that are owned and/oroperated by a company associated with the content system and/or entitiesassociated with internet resources that are owned and/or operated by acompany determined to be reputable.

In some examples, the fourth set of entities may be analyzed todetermine whether duplicates are present in the fourth set of entities,such as where an entity is listed and/or included more than once in thefourth set of entities. Duplications may be identified and/or removed,such as using one or more deduplication techniques, such that the firstcoalition network does not comprise duplicates.

In some examples, the first coalition network and/or one or more othercoalition networks may be determined by performing one or more iterativeprocesses associated with one or more other entities of the secondplurality of entities. For example, multiple iterative processes,comprising the first iterative process, may be performed. Similar to thefirst iterative process beginning with identification of the first setof entities that are related to the second entity, each iterativeprocess of the multiple iterative processes may begin withidentification of a set of entities that are related to an entity of thesecond plurality of entities and/or the first plurality of entities,where the entity may be different for each iterative process of themultiple iterative processes. In an example, a second iterative processof the multiple iterative processes may be performed with respect to aseventh entity of the second plurality of entities, where the seconditerative process begins with identification of a set of entities (ofthe first plurality of entities) that are related to the seventh entity.In another example, a third iterative process of the multiple iterativeprocesses may be performed with respect to an eighth entity of the firstplurality of entities, where the third iterative process begins withidentification of a set of entities (of the second plurality ofentities) that are related to the eighth entity. Iterative processes ofthe multiple iterative processes may be performed with respect to eachentity of at least some of the first plurality of entities and/or thesecond plurality of entities.

In some examples, for each entity of the first plurality of entities, aniterative process of the multiple iterative processes may be performedwith respect to the entity and/or the iterative process may begin withidentification of a set of entities (of the second plurality ofentities) that are related to the entity. In some examples, for eachentity of the second plurality of entities, an iterative process of themultiple iterative processes may be performed with respect to the entityand/or the iterative process may begin with identification of a set ofentities (of the first plurality of entities) that are related to theentity.

Iterative processes of the multiple iterative processes may be performedusing one or more of the techniques described herein with respect to thefirst iterative process. Similar to the identification of the fourth setof entities in the first iterative process, a set of entities may beidentified in a different iterative process of the multiple iterativeprocess. For example, performance of an iterative process of themultiple iterative processes may result in identification of a set ofentities associated with fraudulent activity. Alternatively and/oradditionally, performance of the multiple iterative processes may resultin identification of a plurality of sets of entities associated withfraudulent activity. Each set of entities of the plurality of sets ofentities may be identified in an iterative process of the multipleiterative processes. The plurality of sets of entities may comprise atleast one of the fourth set of entities identified in the firstiterative process, a fifth set of entities identified in the seconditerative process, a sixth set of entities identified in the thirditerative process, etc.

In some examples, the first network profile may be analyzed based uponthe plurality of sets of entities to identify one or more groups of setsof entities (to merge sets of entities together for coalition networkidentification, for example). A group of sets of entities of the one ormore groups of sets of entities may correspond to sets of entities, ofthe plurality of sets of entities, that are related to each other. Forexample, the first network profile may be analyzed based upon the fourthset of entities and one or more other sets of entities of the pluralityof sets of entities to determine whether the fourth set of entities arerelated to the one or more other sets of entities. The fourth set ofentities and one or more other sets of entities may be included in afirst group of sets of entities based upon a determination that thefourth set of entities is related to the one or more other sets ofentities.

In some examples, a determination that the fourth set of entities andthe one or more other sets of entities of the first group of sets ofentities are related is determined based upon a determination that thefourth set of entities comprises entities also comprised in the one ormore other sets of entities. In an example, the first group of sets ofentities may comprise a sixth set of entities. The sixth set of entitiesmay be included in the first group of sets of entities based upon adetermination that the fourth set of entities and the sixth set ofentities are related. The determination that the fourth set of entitiesand the sixth set of entities are related may be based upon adetermination that the fourth set of entities comprises one or morefirst entities also comprised in the sixth set of entities.Alternatively and/or additionally, the determination that the fourth setof entities and the sixth set of entities are related may be based upona determination that the one or more first entities meet a thresholdquantity of entities. Alternatively and/or additionally, thedetermination that the fourth set of entities and the sixth set ofentities are related may be based upon a determination that the one ormore first entities meet a threshold proportion of the fourth set ofentities and/or the sixth set of entities. For example, the one or morefirst entities may meet the threshold proportion if the one or morefirst entities correspond to at least the threshold proportion of thefourth set of entities and/or the one or more first entities correspondto at least the threshold proportion of the sixth set of entities.Alternatively and/or additionally, the one or more first entities maymeet the threshold proportion if the one or more first entitiescorrespond to at least the threshold proportion of a combination of thefourth set of entities and the sixth set of entities.

In some examples, the first coalition network may be determined basedupon the first group of sets of entities. For example, the first groupof sets of entities may be identified and/or recognized as being anetwork of entities used for performing fraudulent activity based uponthe determination that the fourth set of entities and the one or moreother sets of entities are related. In some examples, the firstcoalition network may comprise all entities of the first group of setsof entities. Alternatively and/or additionally, the first coalitionnetwork may comprise a subset of entities of the first group of sets ofentities.

In some examples, one or more entities of the first group of sets ofentities may be excluded from the first coalition network (e.g., the oneor more entities may not be included in the first coalition network).For example, an entity of the first group of sets of entities may beexcluded from the first coalition network based upon a determinationthat the entity is included in the list of non-fraudulent entities.

In some examples, the first group of sets of entities may be analyzed todetermine whether duplicates are present in the first group of sets ofentities, such as where an entity is listed more than once and/or wherean entity is included in more than one set of entities of the group ofsets of entities. Duplications may be removed, such as using one or morededuplication techniques, such that the first coalition network does notcomprise duplicates.

It may be appreciated that the method 600 may be performed withoutgeneration of the first network profile. In some examples, rather than(and/or in addition to) analyzing the first network profile to identifythe first set of entities, the second set of entities, the third set ofentities the first output set of entities and/or the second output setof entities, the first plurality of sets of event information may beanalyzed to identify the first set of entities, the second set ofentities, the third set of entities the first output set of entitiesand/or the second output set of entities.

In some examples, the content system may control transmission and/orreception of data (such as transmission of content items) based uponidentification of a first coalition network, for example the firstcoalition network identified using one or more of the techniquesdescribed with respect to the method 400 of FIG. 4 and/or the firstcoalition network identified using one or more of the techniquesdescribed with respect to the method 600 of FIG. 6.

In some examples, a first request for content associated with a firstclient device and/or a first internet resource may be received by thecontent system. For example, the first request for content may be arequest for the content system to provide a content item (e.g., anadvertisement, an image, a link, a video, etc.) for presentation via thefirst client device using the first internet resource.

In some examples, a first entity associated with the first client deviceand/or a second entity associated with the first internet resource maybe determined based upon the first request for content. For example, thefirst request for content may comprise an indication of the first entityand/or the second entity. The first entity may correspond to at leastone of the first client device, an IP address associated with the firstclient device, a carrier identifier indicative of carrier informationassociated with the first client device, a user identifier (e.g., atleast one of a username, an email address, a user account identifier,etc.) associated with the first client device, a browser cookie, etc.The second entity may correspond to at least one of one or more firstinternet resources comprising the first internet resource, an internetresource identifier associated with the one or more first internetresources, a domain associated with the one or more first internetresources, a host identifier of a host device associated with the one ormore first internet resources, a publisher identifier associated with apublisher of the one or more first internet resources, etc.

In some examples, the first coalition network may be analyzed based uponthe first entity and/or the second entity to determine whether the firstcoalition network comprises the first entity and/or the second entity.In some examples, a content item associated with the first request forcontent may not be transmitted to the first client device based upon adetermination that both the first entity and the second entity are partof the first coalition network. For example, the determination that boththe first entity and the second entity are part of the first coalitionnetwork may correspond to a determination that the first entity and thesecond entity are being used together for performance of fraudulentactivity, such as advertising fraud, and/or that reception of the firstrequest for content is a result of such fraudulent activity.

In some examples, a content item associated with the first request forcontent may not be transmitted to the first client device based upon adetermination that merely the first entity associated with the firstclient device is part of the first coalition network (and/or the secondentity associated with the first internet resource is not part of thefirst coalition network). In some examples, device activity associatedwith the first client device may be analyzed to determine a first fraudlevel associated with the first entity. The device activity may comprisehistorical activity information indicative of historical events in whichthe first client device presented content items provided by the contentsystem. In some examples, the first fraud level may be determined basedupon a first activity level, of the first client device, with entitiesthat are not part of an identified coalition network. In an example, thefirst activity level may be based upon a quantity of events performed bythe first client device with entities that are not part of an identifiedcoalition network. Alternatively and/or additionally, the first activitylevel may be based upon a rate at which events are performed by thefirst client device with entities that are not part of an identifiedcoalition network.

In some examples, a lower level of the first activity level maycorrespond to a higher level of the first fraud level. For example, adetermination that the first client device has a low activity level withentities that are not part of identified coalition networks maycorrespond to a high likelihood that the first client device isexclusively (and/or mainly) used for performance of fraudulent activitywith entities of one or more coalition networks.

Alternatively and/or additionally, a higher level of the first activitylevel may correspond to a lower level of the first fraud level. Forexample, a determination that the first client device has a highactivity level with entities that are not part of the identifiedcoalition networks may correspond to a high likelihood that the firstclient device is not exclusively (and/or mainly) used for performance offraudulent activity with entities of one or more coalition networks. Forexample, the first entity associated with the first client device may beincluded in the first coalition network due to a computer virus,malware, a botnet, a Trojan horse, etc. controlling the first clientdevice perform fraudulent activity with entities of the first coalitionnetwork. However, other activity of the first client device that is notperformed in association with entities of the first coalition networkmay not be fraudulent.

In some examples, responsive to a determination that merely the firstentity associated with the first client device is part of the firstcoalition network (and/or the second entity associated with the firstinternet resource is not part of the first coalition network), the firstfraud level associated with the first entity may be compared with afirst threshold fraud level. A content item associated with the firstrequest for content may not be transmitted to the first client deviceresponsive to determining that the first fraud level associated with thefirst entity exceeds the first threshold fraud level. Alternativelyand/or additionally, a content item associated with the first requestfor content may be selected (via a bidding process, for example) and/ortransmitted to the first client device responsive to determining thatthe first fraud level associated with the first entity does not exceedthe first threshold fraud level.

Alternatively and/or additionally, responsive to a determination thatthe first entity associated with the first client device is part of thefirst coalition network, a content item associated with the firstrequest for content may be selected, based upon the first fraud level,for presentation via the first client device. For example, the firstfraud level may be submitted to a bidding system. A plurality of bidvalues associated with a plurality of content items may be generatedbased upon the first fraud level. A content item may be selected fromthe plurality of content items for presentation via the first clientdevice based upon the plurality of bid values, such as using one or moreof the techniques described herein with respect to FIGS. 5A-5E. In afirst example, the first fraud level may be equal to a first valueand/or a first bid value, of the plurality of bid values, associatedwith a content item of the plurality of content items may be generatedbased upon the first value. In a second example, the first fraud levelmay be equal to a second value, lower than the first value, and/or asecond bid value associated with the content item may be generated basedupon the second value. The first bid value in the first example may belower than the second bid value in the second example (as a result ofthe first fraud level in the first example being higher than the firstfraud level in the second example).

In some examples, a content item associated with the first request forcontent may not be transmitted to the first client device based upon adetermination that merely the second entity associated with the firstinternet resource is part of the first coalition network (and/or thefirst entity associated with the first client device is not part of thefirst coalition network). In some examples, historical activityassociated with the one or more first internet resources (comprising thefirst internet resource) may be analyzed to determine a second fraudlevel associated with the second entity. The historical activity may bedetermined based upon historical activity information indicative ofhistorical events in which the one or more first internet resources wereused to present content items provided by the content system. In someexamples, the second fraud level may be determined based upon a secondactivity level, of the one or more first internet resources, withentities that are not part of an identified coalition network. In anexample, the second activity level may be based upon a quantity ofevents performed by the one or more first internet resources withentities that are not part of an identified coalition network.Alternatively and/or additionally, the second activity level may bebased upon a rate at which events are performed by the one or more firstinternet resources with entities that are not part of an identifiedcoalition network.

In some examples, a lower level of the second activity level maycorrespond to a higher level of the second fraud level. For example, adetermination that the one or more first internet resources have a lowactivity level with entities that are not part of identified coalitionnetworks may correspond to a high likelihood that the one or more firstinternet resources are exclusively (and/or mainly) used for performanceof fraudulent activity with entities of one or more coalition networks.

Alternatively and/or additionally, a higher level of the second activitylevel may correspond to a lower level of the second fraud level. Forexample, a determination that the one or more first internet resourceshave a high activity level with entities that are not part of theidentified coalition networks may correspond to a high likelihood thatthe first client device is not exclusively (and/or mainly) used forperformance of fraudulent activity with entities of one or morecoalition networks.

In some examples, responsive to a determination that merely the secondentity associated with the first internet resource is part of the firstcoalition network (and/or the first entity associated with the firstclient device is not part of the first coalition network), the secondfraud level associated with the second entity may be compared with asecond threshold fraud level. A content item associated with the firstrequest for content may not be transmitted to the first client deviceresponsive to determining that the second fraud level associated withthe second entity exceeds the second threshold fraud level.Alternatively and/or additionally, a content item associated with thesecond request for content may be selected (via a bidding process, forexample) and/or transmitted to the first client device responsive todetermining that the second fraud level associated with the secondentity does not exceed the second threshold fraud level.

Alternatively and/or additionally, responsive to a determination thatthe second entity associated with the first internet resource is part ofthe first coalition network, a content item associated with the firstrequest for content may be selected, based upon the second fraud level,for presentation via the first client device. For example, the secondfraud level may be submitted to a bidding system. A plurality of bidvalues associated with a plurality of content items may be generatedbased upon the second fraud level. A content item may be selected fromthe plurality of content items for presentation via the first clientdevice based upon the plurality of bid values, such as using one or moreof the techniques described herein, such as with respect to FIG. 5D.

It may be appreciated that the disclosed subject matter may preventfraudulent activity, including, but not limited to, advertising fraud.For example, employing one or more of the techniques presented herein,such as at least one of analyzing activity associated with entities on anetwork-level (such as analyzing the first plurality of sets of eventinformation), generating the first network profile associated withentities based upon the first plurality of sets of event information,generating representations associated with the entities, identifyingclusters based upon the representations, identifying coalition networksbased upon the clusters, performing iterative processes to identifycoalition networks, etc., results in accurate identification ofcoalition networks associated with fraudulent activity. The coalitionnetworks identified using one or more of the techniques presented hereinmay include entities that otherwise may have gone undetected using othersystems, such as systems that attempt to detect fraud at an entity-leveland/or an event-level and/or systems that analyze activity and/ortraffic associated with a device and/or an advertisement signal todetermine, such as based upon computation limits, whether the deviceand/or the advertisement signal is fraudulent. For example, such systemsmay not detect fraudulent entities of a coalition network because eachindividual entity may be controlled to look and/or act sufficiently likea legitimate user. Accordingly, it may be necessary to use one or moreof the techniques herein to identify the entity as associated with acoalition network associated with fraudulent activity. Thus, byimplementing one or more of the techniques herein, it may be moredifficult for a malicious entity to perform fraudulent activity withoutbeing detected.

Further, malicious entities may be discouraged from performing maliciousactions (e.g., using one or more automated operation functionalities,hacking techniques, malware, etc.) to control client devices fortransmission of advertisement requests because, by implementing one ormore of the techniques presented herein, it is more difficult for amalicious entity to successfully control a client device fortransmission of a fraudulent advertisement request without beingdetected as part of a coalition network.

Implementation of at least some of the disclosed subject matter may leadto benefits including, but not limited to, a reduction in transmissionof fraudulent advertisement requests (and/or a reduction in bandwidth)(e.g., as a result of discouraging malicious entities from performingmalicious actions to control client devices for transmission ofadvertisement requests).

Alternatively and/or additionally, implementation of at least some ofthe disclosed subject matter may lead to benefits including a reductionin transmission of content items based upon fraudulent advertisementrequests (and/or a reduction in bandwidth) (e.g., as a result ofidentifying a coalition network associated with fraudulent activity, asa result of controlling transmission of data, such as content itemsand/or advertisements, to entities of the coalition network based uponthe identification of the coalition network, etc.).

Alternatively and/or additionally, implementation of at least some ofthe disclosed subject matter may lead to benefits including preventingmalicious entities from receiving compensation for performing fraudulentactivity (e.g., as a result of identifying a coalition networkassociated with fraudulent activity, as a result of controllingtransmission of data, such as content items and/or advertisements, toentities of the coalition network based upon the identification of thecoalition network, etc.).

Alternatively and/or additionally, implementation of at least some ofthe disclosed subject matter may lead to benefits including a reductionin instances that client devices are hacked and/or controlled fortransmission of fraudulent advertisement requests (e.g., as a result ofdiscouraging malicious entities from performing malicious actions tocontrol client devices for transmission of fraudulent advertisementrequests).

Alternatively and/or additionally, implementation of at least some ofthe disclosed subject matter may lead to benefits including reducingunauthorized access of client devices and/or the content system (e.g.,as a result of discouraging malicious entities from performing maliciousactions to control client devices for transmission of fraudulentadvertisement requests). Alternatively and/or additionally,implementation of at least some of the disclosed subject matter may leadto benefits including decreasing security resources needed to protectclient devices and/or the content system from unauthorized access.

In some examples, at least some of the disclosed subject matter may beimplemented on a client device, and in some examples, at least some ofthe disclosed subject matter may be implemented on a server (e.g.,hosting a service accessible via a network, such as the Internet).

FIG. 8 is an illustration of a scenario 800 involving an examplenon-transitory machine readable medium 802. The non-transitory machinereadable medium 802 may comprise processor-executable instructions 812that when executed by a processor 816 cause performance (e.g., by theprocessor 816) of at least some of the provisions herein (e.g.,embodiment 814). The non-transitory machine readable medium 802 maycomprise a memory semiconductor (e.g., a semiconductor utilizing staticrandom access memory (SRAM), dynamic random access memory (DRAM), and/orsynchronous dynamic random access memory (SDRAM) technologies), aplatter of a hard disk drive, a flash memory device, or a magnetic oroptical disc (such as a compact disc (CD), digital versatile disc (DVD),or floppy disk). The example non-transitory machine readable medium 802stores computer-readable data 804 that, when subjected to reading 806 bya reader 810 of a device 808 (e.g., a read head of a hard disk drive, ora read operation invoked on a solid-state storage device), express theprocessor-executable instructions 812. In some embodiments, theprocessor-executable instructions 812, when executed, cause performanceof operations, such as at least some of the example method 400 of FIG. 4and/or the example method 600 of FIG. 6, for example. In someembodiments, the processor-executable instructions 812 are configured tocause implementation of a system, such as at least some of the exemplarysystem 501 of FIGS. 5A-5H and/or the exemplary system 701 of FIGS.7A-7B, for example.

3. Usage of Terms

As used in this application, “component,” “module,” “system”,“interface”, and/or the like are generally intended to refer to acomputer-related entity, either hardware, a combination of hardware andsoftware, software, or software in execution. For example, a componentmay be, but is not limited to being, a process running on a processor, aprocessor, an object, an executable, a thread of execution, a program,and/or a computer. By way of illustration, both an application runningon a controller and the controller can be a component. One or morecomponents may reside within a process and/or thread of execution and acomponent may be localized on one computer and/or distributed betweentwo or more computers.

Unless specified otherwise, “first,” “second,” and/or the like are notintended to imply a temporal aspect, a spatial aspect, an ordering, etc.Rather, such terms are merely used as identifiers, names, etc. forfeatures, elements, items, etc. For example, a first object and a secondobject generally correspond to object A and object B or two different ortwo identical objects or the same object.

Moreover, “example” is used herein to mean serving as an instance,illustration, etc., and not necessarily as advantageous. As used herein,“or” is intended to mean an inclusive “or” rather than an exclusive“or”. In addition, “a” and “an” as used in this application aregenerally be construed to mean “one or more” unless specified otherwiseor clear from context to be directed to a singular form. Also, at leastone of A and B and/or the like generally means A or B or both A and B.Furthermore, to the extent that “includes”, “having”, “has”, “with”,and/or variants thereof are used in either the detailed description orthe claims, such terms are intended to be inclusive in a manner similarto the term “comprising”.

Although the subject matter has been described in language specific tostructural features and/or methodological acts, it is to be understoodthat the subject matter defined in the appended claims is notnecessarily limited to the specific features or acts described above.Rather, the specific features and acts described above are disclosed asexample forms of implementing at least some of the claims.

Furthermore, the claimed subject matter may be implemented as a method,apparatus, or article of manufacture using standard programming and/orengineering techniques to produce software, firmware, hardware, or anycombination thereof to control a computer to implement the disclosedsubject matter. The term “article of manufacture” as used herein isintended to encompass a computer program accessible from anycomputer-readable device, carrier, or media. Of course, manymodifications may be made to this configuration without departing fromthe scope or spirit of the claimed subject matter.

Various operations of embodiments are provided herein. In an embodiment,one or more of the operations described may constitute computer readableinstructions stored on one or more computer and/or machine readablemedia, which if executed will cause the operations to be performed. Theorder in which some or all of the operations are described should not beconstrued as to imply that these operations are necessarily orderdependent. Alternative ordering will be appreciated by one skilled inthe art having the benefit of this description. Further, it will beunderstood that not all operations are necessarily present in eachembodiment provided herein. Also, it will be understood that not alloperations are necessary in some embodiments.

Also, although the disclosure has been shown and described with respectto one or more implementations, equivalent alterations and modificationswill occur to others skilled in the art based upon a reading andunderstanding of this specification and the annexed drawings. Thedisclosure includes all such modifications and alterations and islimited only by the scope of the following claims. In particular regardto the various functions performed by the above described components(e.g., elements, resources, etc.), the terms used to describe suchcomponents are intended to correspond, unless otherwise indicated, toany component which performs the specified function of the describedcomponent (e.g., that is functionally equivalent), even though notstructurally equivalent to the disclosed structure. In addition, while aparticular feature of the disclosure may have been disclosed withrespect to only one of several implementations, such feature may becombined with one or more other features of the other implementations asmay be desired and advantageous for any given or particular application.

What is claimed is:
 1. A method, comprising: identifying a first plurality of sets of event information associated with a first plurality of events, wherein: the first plurality of events is associated with a first plurality of entities corresponding to a client-side entity type and a second plurality of entities corresponding to an internet resource-side entity type; a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events; and the first set of event information is indicative of: a first entity, of the first plurality of entities, associated with the first event; and a second entity, of the second plurality of entities, associated with the first event; generating, based upon the first plurality of sets of event information, a first network profile associated with the first plurality of entities and the second plurality of entities, wherein the first network profile is indicative of one or more first sets of event metrics associated with the first entity and one or more entities comprising the second entity, wherein: the second plurality of entities comprises the one or more entities; and a first set of event metrics of the one or more first sets of event metrics corresponds to a measure of events associated with the first entity and the second entity; generating, based upon the first network profile, a first plurality of representations associated with the first plurality of entities; generating, based upon the first network profile, a second plurality of representations associated with the second plurality of entities; identifying a first plurality of clusters in the first plurality of representations, wherein a first cluster of the first plurality of clusters corresponds to a first set of representations of the first plurality of representations associated with the first plurality of entities corresponding to the client-side entity type; identifying a second plurality of clusters in the second plurality of representations, wherein a second cluster of the second plurality of clusters corresponds to a second set of representations of the second plurality of representations associated with the second plurality of entities corresponding to the internet resource-side entity type; analyzing the first network profile to determine a relationship between (i) a first set of entities associated with the first cluster associated with the client-side entity type and (ii) a second set of entities associated with the second cluster associated with the internet resource-side entity type; and identifying a coalition network associated with fraudulent activity based upon the relationship determined between (i) the first set of entities associated with the client-side entity type and (ii) the second set of entities associated with the internet resource-side entity type.
 2. The method of claim 1, wherein a third entity of the first set of entities is associated with a first client device, the method comprising: receiving a first request for content associated with the first client device; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.
 3. The method of claim 1, wherein a third entity of the second set of entities is associated with a first internet resource, the method comprising: receiving a first request associated with a first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.
 4. The method of claim 1, wherein a third entity of the first set of entities is associated with a first client device and a fourth entity of the second set of entities is associated with a first internet resource, the method comprising: receiving a first request associated with the first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity and the fourth entity are associated with the coalition network.
 5. The method of claim 1, wherein: the determination that the first set of entities and the second set of entities are related is based upon a determination that one or more first events of the first plurality of events are associated with one or more first entities of the first set of entities and one or more second entities of the second set of entities.
 6. The method of claim 5, wherein: the determination that the first set of entities and the second set of entities are related is based upon a determination that the one or more first events exceeds a threshold quantity of events.
 7. The method of claim 1, wherein: the generating the first plurality of representations associated with the first plurality of entities comprises generating a first representation associated with the first entity based upon the one or more first sets of event metrics associated with the first entity; and the generating the second plurality of representations associated with the second plurality of entities comprises generating a second representation associated with the second entity based upon one or more second sets of event metrics, of the first network profile, associated with the second entity.
 8. The method of claim 7, wherein: the first representation of the first plurality of representations is a first vector representation; and the second representation of the second plurality of representations is a second vector representation.
 9. The method of claim 8, wherein: the identifying the first plurality of clusters comprises identifying the first cluster based upon a determination that a first density of the first set of representations corresponding to the first cluster exceeds a first threshold density; and the identifying the second plurality of clusters comprises identifying the second cluster based upon a determination that a second density of the second set of representations corresponding to the second cluster exceeds a second threshold density.
 10. The method of claim 1, wherein: an event of the first plurality of events corresponds to at least one of: a presentation of a first content item via a first client device; or a selection of a second content item via a second client device.
 11. The method of claim 1, wherein: an entity of the first plurality of entities is associated with a client device; and an entity of the second plurality of entities is associated with an internet resource.
 12. The method of claim 1, wherein: the first set of event metrics is indicative of at least one of: a rate at which events associated with the first entity and the second entity occur; or a quantity of events associated with the first entity and the second entity.
 13. A computing device comprising: a processor; and memory comprising processor-executable instructions that when executed by the processor cause performance of operations, the operations comprising: identifying a first plurality of sets of event information associated with a first plurality of events, wherein: the first plurality of events is associated with a first plurality of entities corresponding to a client-side entity type and a second plurality of entities corresponding to an internet resource-side entity type; a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events; and the first set of event information is indicative of: a first entity, of the first plurality of entities, associated with the first event; and a second entity, of the second plurality of entities, associated with the first event; generating, based upon the first plurality of sets of event information, a first network profile associated with the first plurality of entities and the second plurality of entities, wherein the first network profile is indicative of one or more first sets of event metrics associated with the first entity and one or more entities comprising the second entity, wherein: the second plurality of entities comprises the one or more entities; and a first set of event metrics of the one or more first sets of event metrics corresponds to a measure of events associated with the first entity and the second entity; generating, based upon the first network profile, a first plurality of representations associated with a third plurality of entities comprising the first plurality of entities and the second plurality of entities; identifying a first plurality of clusters in the first plurality of representations, wherein: a first cluster of the first plurality of clusters corresponds to a first set of representations of the first plurality of representations associated with the third plurality of entities comprising the first plurality of entities corresponding to the client-side entity type and the second plurality of entities corresponding to the internet resource-side entity type; and the first set of representations is associated with a first set of entities of the first plurality of entities and a second set of entities of the second plurality of entities; and identifying a coalition network associated with fraudulent activity based upon a relationship between (i) the first set of entities associated with the client-side entity type and (ii) the second set of entities associated with the internet resource-side entity type.
 14. The computing device of claim 13, wherein a third entity of the first set of entities is associated with a first client device, the operations comprising: receiving a first request for content associated with the first client device; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.
 15. The computing device of claim 13, wherein a third entity of the second set of entities is associated with a first internet resource, the operations comprising: receiving a first request associated with a first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.
 16. The computing device of claim 13, wherein a third entity of the first set of entities is associated with a first client device and a fourth entity of the second set of entities is associated with a first internet resource, the operations comprising: receiving a first request associated with the first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity and the fourth entity are associated with the coalition network.
 17. A non-transitory machine readable medium having stored thereon processor-executable instructions that when executed cause performance of operations, the operations comprising: identifying a first plurality of sets of event information associated with a first plurality of events, wherein: the first plurality of events is associated with a first plurality of entities corresponding to a first device or resource entity type and a second plurality of entities corresponding to a second device or resource entity type, wherein the first device or resource entity type is different than the second device or resource entity type; a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events; and the first set of event information is indicative of: a first entity, of the first plurality of entities, associated with the first event; and a second entity, of the second plurality of entities, associated with the first event; generating, based upon the first plurality of sets of event information, a first network profile associated with the first plurality of entities and the second plurality of entities, wherein the first network profile is indicative of one or more first sets of event metrics associated with the first entity and one or more entities comprising the second entity, wherein: the second plurality of entities comprises the one or more entities; and a first set of event metrics of the one or more first sets of event metrics corresponds to a measure of events associated with the first entity and the second entity; generating, based upon the first network profile, a first plurality of representations associated with the first plurality of entities; generating, based upon the first network profile, a second plurality of representations associated with the second plurality of entities; identifying a first plurality of clusters in the first plurality of representations, wherein a first cluster of the first plurality of clusters corresponds to a first set of representations of the first plurality of representations associated with the first plurality of entities corresponding to the first device or resource entity type; identifying a second plurality of clusters in the second plurality of representations, wherein a second cluster of the second plurality of clusters corresponds to a second set of representations of the second plurality of representations associated with the second plurality of entities corresponding to the second device or resource entity type; analyzing the first network profile to determine a relationship between (i) a first set of entities associated with the first cluster associated with the first device or resource entity type and (ii) a second set of entities associated with the second cluster associated with the second device or resource entity type; and identifying a coalition network associated with fraudulent activity based upon the relationship determined between (i) the first set of entities associated with the first device or resource entity type and (ii) the second set of entities associated with the second device or resource entity type.
 18. The non-transitory machine readable medium of claim 17, wherein a third entity of the first set of entities is associated with a first client device, the operations comprising: receiving a first request for content associated with the first client device; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.
 19. The non-transitory machine readable medium of claim 17, wherein a third entity of the second set of entities is associated with a first internet resource, the operations comprising: receiving a first request associated with a first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.
 20. The non-transitory machine readable medium of claim 17, wherein a third entity of the first set of entities is associated with a first client device and a fourth entity of the second set of entities is associated with a first internet resource, the operations comprising: receiving a first request associated with the first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity and the fourth entity are associated with the coalition network. 